Hotel Phishing Clears All Email Security Filters: Microsoft Names New Attack Class

An active phishing campaign targeting hotels across Europe and Asia since April 2026 has exposed a structural gap in enterprise email security — one that allows malicious messages to pass every standard authentication check a corporate inbox runs.

Microsoft Threat Intelligence formally disclosed the operation on June 25, 2026, naming the delivery method authentication laundering and calling it a new documented evasion class with implications that reach far beyond any single industry.

The issue is not a bug in any email platform. It is a design boundary — and one that grows more consequential with every new SaaS tool that sends automated notifications on behalf of its users.

Enterprise email security rests on three standards that together form the foundation of spam and phishing defense: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Together, these checks verify one thing: that the server sending an email is authorized to send on behalf of the claimed domain. SPF confirms the sending IP is on an approved list. DKIM confirms a cryptographic signature was applied by the domain owner. DMARC confirms the two results align with the From: header.

What none of them do — what none of them were designed to do — is evaluate whether the content of a passing message is malicious.

The attackers in this campaign exploited that boundary precisely. They registered a legitimate Calendly account and used it to send phishing messages through Calendly's own SendGrid-based infrastructure. Because the email was genuinely dispatched from Calendly's authorized servers, SPF passed. Because Calendly applied a valid cryptographic signature, DKIM passed. Because the calendly.com domain aligned correctly, DMARC passed. The composite verdict from every filter the message encountered: clean.

The email landed in hotel inboxes looking indistinguishable from a legitimate scheduling notification.

The lures were written specifically for hotel front-desk staff, arriving in Japanese, Danish, and Dutch — Japanese was the most common language — and referencing guest complaints, bedbug reports, room condition inquiries, verification call notices, and stay reviews. Subject lines warned of final notices, threatened health authority inspections, and implied suspension of operations. No recipient name and no property name appeared in any message, a pattern consistent with high-volume list-based sending rather than targeted spear phishing.

Each email embedded a Calendly redirect URL that kicked off a four-hop chain: from a Calendly link to Google's .google redirect service, then to a Cloudflare-hosted domain in the .cfd top-level domain, then to a Cloudflare Turnstile human-verification challenge designed to block automated analysis tools. Passing the challenge served a browser-downloaded archive named photo-[random numbers].zip.

Inside: a Windows shortcut file disguised as a .png image.

When a hotel employee opened the file expecting a photo, PowerShell executed. The script used a BigInt-based arithmetic decoder to deobfuscate a download URL, fetched a second PowerShell script to a temporary folder, and pulled down a legitimate Node.js runtime — Node v24.13.0, a signed, trusted software package from the official nodejs.org website — to serve as the execution vehicle.

A second wave of the campaign added an intermediate step: the downloaded script triggered dynamic .NET DLL compilation through csc.exe and cvtres.exe, producing a randomly named DLL before proceeding to the Node.js stage.

The Node.js runtime — legitimate and digitally signed — then executed a malicious JavaScript payload that ran entirely in memory, writing no detectable executable file to disk. The implant established persistence through two separate Windows registry run keys and modified Microsoft Defender's exclusion list to conceal itself and any randomly named executables from real-time scanning.

Device names recovered from compromised machines included reception, frontdesk, reservations, accueil, and recepce — names that confirm the campaign targeted front-office workstations specifically, the machines connected to property management systems, payment infrastructure, guest databases, and reservation systems.

Post-compromise activity included beaconing to command-and-control servers over non-standard network ports and on-device compilation of portable executable payloads. Microsoft has not attributed the campaign to a known threat actor. The ultimate objective remains unclear, though the investment in obfuscation across two distinct waves indicates preparation for sustained follow-on activity.

Cisco Talos independently documented the same category of attack in April 2026, calling it Platform-as-a-Proxy . Researchers there found attackers exploiting the notification systems of GitHub and Jira in an identical fashion — using legitimate platform infrastructure to send phishing content that satisfied every standard authentication requirement. On one peak day in February 2026, roughly 2.89% of all emails originating from GitHub's infrastructure were associated with this abuse.

The structural implication is broad. Any SaaS platform that sends automated email notifications on behalf of its users can serve as a relay for this class of attack. Scheduling tools, e-signature platforms, project management systems, customer relationship management software, invoicing tools, and HR workflow platforms all send email through infrastructure that carries trusted authentication credentials — because that infrastructure is legitimate even when the content it carries is not.

The authentication laundering and Platform-as-a-Proxy names describe the same underlying mechanism. Neither fixes it. SPF, DKIM, and DMARC authenticate sending infrastructure by design — they have no mandate and no mechanism to evaluate message content. Closing this gap requires moving detection upstream, to the behavioral layer: not who sent the email, but what the email asks the recipient to do.

The hospitality industry processes unusually high volumes of unsolicited external communications — guest complaints, inspection notices, booking inquiries, review alerts. Front-desk staff are trained to respond quickly to messages from strangers. That combination makes hospitality workers more likely to open a pressure-framed message from an unknown sender than workers in most other industries.

The targets inside hotels are also valuable. Front-desk terminals connect directly to property management infrastructure, payment processing, guest databases, and reservation systems. Accessing one compromised workstation can yield access to all of them.

Two recent large-scale incidents illustrate how useful hotel guest data is to attackers once they have it. The Otelier hotel management platform breach, disclosed in January 2025 , exposed records linked to Marriott, Hilton, and Hyatt, including 437,000 guest email addresses, 39 million reservation records, and 7.8 terabytes of data exfiltrated from cloud storage. BWH Hotels — the group behind Best Western and more than 4,000 properties in over 100 countries — disclosed in May 2026 that attackers had maintained access to its guest reservation system from October 14, 2025 through April 22, 2026, exposing guest names, details, and reservation information.

European properties face an additional exposure layer under the EU's General Data Protection Regulation, where a breach exposing guest personal data can carry penalties of up to 4% of global annual revenue. The guest data categories that make hotel systems attractive targets — names, details, reservation dates, payment records — are precisely those whose unauthorized disclosure triggers mandatory GDPR notification requirements.

A Calendly notification that results in a downloaded ZIP file is not a normal Calendly workflow under any circumstances.

Calendly is a scheduling tool. Its legitimate notification emails are appointment confirmations, scheduling invitations, and calendar reminders. They do not prompt users to download compressed archives, open photo files, or click through multi-step verification challenges to view a guest complaint. A Calendly notification that does any of these things is using the platform as a delivery relay, not as a scheduling service.

The behavioral signal that gives this campaign away is not the sender domain — which is genuinely Calendly's — and not the display name, which accurately identifies the sending platform. It is what the email asks the recipient to do. Standard phishing training teaches employees to check whether the sender's domain looks right. In this campaign, the domain is calendly.com. The display name is "Booking Manager (via Calendly)." Both are accurate. Neither is a warning sign.

What the campaign cannot disguise is the four-hop redirect chain, the .cfd top-level domain, the Cloudflare verification gate, and the compressed archive waiting at the end. Those are the indicators — and none of them are detectable by reading a sender address.

Microsoft published detection guidance on June 25, 2026 and recommended security teams monitor for: Node.js processes spawning from unexpected parent processes; PowerShell activity involving BigInt decoding patterns; registry persistence entries created by unfamiliar processes; and outbound traffic on non-standard ports. Defender users should consult the advisories Microsoft published alongside the June 25 disclosure.

For broader enterprise environments, Cisco Talos recommended that organizations stop treating SaaS platform emails as inherently trustworthy. Security teams should ingest GitHub, Jira, and Calendly API audit logs into SIEM or SOAR platforms to detect precursor behaviors — unusual account creation, bulk notifications, messages carrying financial or urgency-driven content that conflicts with the platform's intended purpose — before any phishing email is sent.

User awareness training must now cover a different behavioral cue than the one most employees have learned. The question is no longer whether the sender's email address matches the company's domain. The question is whether the action the email requests is consistent with what that platform normally asks users to do. A scheduling notification that ends in a ZIP file download fails that test completely, regardless of how authenticated its delivery infrastructure appears.

This article is copyrighted by Travelers Today, the travel news leader

This article is copyrighted by Travelers Today, the travel news leader