Japan Hotel Industry Targeted With TONResolver RAT and Guest Complaint Phishing Emails

Gbhackers •Mayura Kathir • June 30, 2026

Japan’s hotel sector is the latest target of a sophisticated phishing and remote-access trojan (RAT) campaign that leverages guest-complaint lures and an unusual resilience mechanism: a TON blockchain–based dead-drop resolver. Beginning in late May 2026, attackers sent highly targeted emails to Booking.com partner properties in Japan with subject lines such as “重要：ゲスト滞在レビュー依頼” (Important: Guest Stay […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Targets Japan's Hotels Using TONResolver RAT In late May 2026, a phishing campaign targeting Japan's hotel industry was identified, utilizing emails that impersonated guest complaints to deliver the TONResolver RAT. The emails, sent to Booking.com partner accommodations, contained malicious links leading to a ZIP file with a disguised shortcut file (LNK) that installed the TrojanSpy.JS.TONRESOLVER.A malware. This malware exploits the TON blockchain as a dead drop resolver, complicating detection and takedown efforts. Japanese hotels were primarily targeted, although other countries were also affected. The attack method bypassed traditional email security measures like SPF, DKIM, and DMARC. The persistent nature of the malware poses ongoing risks for credential theft and further compromises. Trend Micro's TrendAI Research confirmed the attack's details and scope, emphasizing the sophistication of the phishing tactics employed. 5 sources 67

Extracted Entities

Japan Hotel Industry Targeted With TONResolver RAT and Guest Complaint Phishing Emails

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)