A hotel phishing email may not look like much, a guest complaint, a bedbug report, a final warning from a health inspector. But Microsoft’s security team has flagged an active campaign using exactly these messages to compromise hotel systems across Europe and Asia. If your business involves employees regularly opening documents or photos from unfamiliar people, here is what you need to know and why it is more manageable than it sounds.
The Bait
The attack begins with an email designed to trigger an immediate response from front desk or reservations staff. The message may claim to be a furious guest complaint, a bedbug report, or a final warning about a health inspection. Microsoft observed versions written in Japanese, Danish, and Dutch, with each message relying heavily on urgency and concern for the hotel’s reputation. These are exactly the kinds of situations employees feel compelled to address immediately.
The email contains a link to download a file with a name similar to photo-12345.zip. Inside the ZIP archive appears to be an image file. It is not. Instead, it contains a disguised shortcut that quietly launches malicious software the moment someone double-clicks it, believing they are opening a photo.
The Clever Part
Two aspects make this campaign especially worth understanding.
First, the emails are difficult to detect. Instead of sending messages from suspicious domains, the attackers route them through legitimate and trusted services. Microsoft identified Calendly and Google’s link redirect service as examples. Because the emails pass through authorized systems, standard email authentication checks recognize them as legitimate. Microsoft refers to this technique as authentication laundering.
The important takeaway is simple. Just because an email passes authentication checks does not mean it is safe. It only means the message traveled through an authorized system.
Second, once the malware is installed, it is designed to remain on the system. The attackers use hidden software to communicate with their infrastructure and automatically restart after a reboot. Microsoft found that the malware establishes persistence in two separate locations, if one component is removed, the second can quietly reinstall it later.
Microsoft documented an incident where Defender successfully removed part of the malware. Nearly two days later, the remaining component restored the infection without any user interaction.
What the Attackers Are After
Microsoft has not yet determined the attackers’ ultimate objective and has not attributed the campaign to a known threat group. Based on the level of effort invested in stealth and persistence, Microsoft believes the attackers may be preparing compromised systems for future activity. The campaign continues to evolve.
What This Means for Your Business
The good news is that you do not need to be a cybersecurity expert to meaningfully reduce your risk. A few practical steps go a long way.
Train your frontline employees. Reception staff, reservations personnel, and anyone responsible for handling guest emails are the primary targets. A ZIP file that supposedly contains only a photo should immediately raise suspicion. Emotionally charged messages designed to create urgency, an angry guest, a final warning, an upcoming inspection, are a common tactic to pressure employees into acting without thinking. When in doubt, verify the request using a trusted phone number before opening any files.
Know that one antivirus alert is not necessarily the end of the story. As Microsoft’s research shows, this malware is specifically designed to survive partial cleanup. If you believe a system has been compromised, a thorough investigation is the safest path forward.
Consider whether your cybersecurity coverage has any gaps. This campaign demonstrates the value of continuous monitoring and experienced security professionals who know what to look for.
If you have questions about whether your business is protected against attacks like this hotel phishing email campaign, we are happy to take a look. There is no obligation, just a straightforward conversation about where you stand.
This article is based on research published by Microsoft Threat Intelligence on June 25, 2026. Cybersecurity threats evolve quickly, and attacker techniques can change over time. Information in this article is current as of June 26, 2026. For the latest guidance, refer to Microsoft’s original advisory.