TONResolver Malware Uses TON Smart Contracts as Dead Drop Resolver for C2 Switching

Cybersecuritynews •Tushar Subhra Dutta • June 30, 2026

A new wave of cyberattacks targeting Japan’s hospitality sector has put the global threat landscape on high alert. In late May 2026, attackers began sending phishing emails to Japanese partner companies of Booking.com, disguised as urgent guest complaints and review requests. The goal was to trick hotel staff into opening malicious files that handed remote […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Targets Japan's Hotels Using TONResolver RAT In late May 2026, a phishing campaign targeting Japan's hotel industry was identified, utilizing emails that impersonated guest complaints to deliver the TONResolver RAT. The emails, sent to Booking.com partner accommodations, contained malicious links leading to a ZIP file with a disguised shortcut file (LNK) that installed the TrojanSpy.JS.TONRESOLVER.A malware. This malware exploits the TON blockchain as a dead drop resolver, complicating detection and takedown efforts. Japanese hotels were primarily targeted, although other countries were also affected. The attack method bypassed traditional email security measures like SPF, DKIM, and DMARC. The persistent nature of the malware poses ongoing risks for credential theft and further compromises. Trend Micro's TrendAI Research confirmed the attack's details and scope, emphasizing the sophistication of the phishing tactics employed. 5 sources 67

Extracted Entities

TONResolver Malware Uses TON Smart Contracts as Dead Drop Resolver for C2 Switching

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Countries (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)