Microsoft has warned of an active phishing campaign targeting hospitality organizations across Europe and Asia since April 2026. The attackers use photo-themed ZIP files to drop a Node.js implant, aiming to compromise front-desk machines. The end goal of the operators remains unclear, but the campaign leverages common hotel workflows for initial access.