Urgent Alert: Spear-Phishing Campaign Targets Hotel Staff

• •Spear-phishing emails impersonate guests to trick hotel staff.
• •At least one device infection has been confirmed in Andorra.
• •The malware is polymorphic, complicating detection efforts.

A spear-phishing campaign has been detected targeting hotel reception staff, with at least one confirmed device infection. The Andorra National Cybersecurity Agency (ANC-AD) issued an urgent alert on August 28, 2026, detailing that attackers impersonate angry guests to trick staff into downloading malware. The emails, sent from free messaging accounts, claim physical assaults by hotel employees and demand urgent responses. Links in the emails redirect through legitimate Google infrastructure to attacker-controlled domains, leading to malware disguised as photos. The malware is polymorphic, creating unique variants to evade detection. Hotels in Andorra are particularly at risk, prompting the agency to recommend immediate checks of reservation inboxes and enhanced security measures. The campaign's sophistication poses a significant threat to the tourism sector. As of now, the authorship of the attacks remains unconfirmed.