Hotels Are Getting Phished Through Booking Complaints

Since April 2026, hotel front-desk staff across Europe and Asia have been receiving emails that look like legitimate guest complaints, according to Microsoft's threat intelligence team. The emails mention bedbug reports, health inspections, and stay reviews — exactly the kind of thing a hotel worker feels pressure to click on immediately. The sender display name reads "Booking Manager (via Calendly)", and the messages have arrived in Japanese, Danish, and Dutch.

Here is what makes this one harder to catch than most. The attackers route their emails through Calendly's notification system and Google's redirect service, so standard email authentication checks — the kind your mail server runs automatically to verify a sender is legitimate — actually pass. The email really did come from Calendly's servers. Those checks cannot tell you what the message is for.

Click the link, and you land on a fresh domain hiding behind Cloudflare's bot-detection system. That challenge also blocks automated security scanners from analysing the page. Pass the challenge and you download a ZIP file. Inside is a file disguised as a photo — but opening it fires PowerShell, which quietly installs a legitimate Node.js runtime and runs a JavaScript implant called TonRAT. The implant uses the TON blockchain to look up its command server on the fly, making it harder to block with static lists.

No confirmed data theft has been reported yet, but the access is persistent and the attacker's intent is still unknown. That combination is worth taking seriously.

What to do: If you work in hospitality, or know someone who does, treat any email referencing guest complaints or inspections as suspicious — especially ones with ZIP attachments. Do not open files from unexpected booking-related emails, even if the sender looks familiar.

Researchers at SentinelOne have identified a new macOS malware family, attributed with high confidence to a North Korean-linked threat actor, that contains a trick security researchers have not seen before, according to Bleeping Computer.

The malware — named Gaslight — embeds 38 fake system messages inside its code. These mimic crash reports, memory dumps, token expiry warnings, and build errors. They are written in the formatting style that AI analysis tools are trained to read. The goal is not to evade a sandbox (an isolated environment where security teams safely detonate malware), but to confuse the AI assistant reading the output — making it think its own analysis session has broken down and should be abandoned.

It is the software equivalent of telling the security camera operator that the monitor is broken. SentinelOne notes the technique did not demonstrably bypass any specific platform, but the intent is clear: attackers are now designing malware with AI defences specifically in mind.

What to do: If your organisation uses AI-assisted security tooling, ask your vendor how their platform handles prompt injection (attempts to manipulate AI behaviour through embedded instructions) in analysed samples.

What PTC Windchill is: Windchill is enterprise software used by manufacturers — in industries like automotive, aerospace, and defence — to manage the full lifecycle of a product, from design files and engineering specs through to compliance records. Think of it as the document nervous system of a factory floor.

What it is: This flaw is an improper input validation vulnerability, meaning the software fails to check whether data sent to it is safe before acting on it. A remote attacker with no login credentials can send a specially crafted request to the server and execute arbitrary code — essentially run any command they choose.

Who's at risk: Any organisation running an unpatched version of Windchill or FlexPLM that is reachable from the internet, or from an internal network an attacker has already accessed. Industrial and manufacturing companies are the primary targets here.

CVSS: Not publicly confirmed at time of writing — treat as Critical until scored. CISA has added it to its Known Exploited Vulnerabilities catalogue and set a federal patch deadline of 28 June 2026.

Root cause: The application does not adequately validate the structure or content of incoming requests before processing them. When input validation (the process of checking that data matches what the application expects) is skipped or insufficient, an attacker can craft requests that the server interprets as legitimate instructions. The server then executes whatever the attacker embedded in that request.

Attack vector: An unauthenticated attacker sends a malformed HTTP request to the Windchill server. Because the application does not verify the input properly, it processes the request and executes code supplied by the attacker. Confirmed attacks have used this to deploy persistent JSP webshells — small scripts planted on the server that let the attacker issue commands and pull data long after the initial intrusion. Data exfiltration (removing data from the system without authorisation) has also been observed.

Detection strategies: Look for unfamiliar .jsp files created recently in web-accessible directories on your Windchill server. Monitor for unusual outbound connections originating from the Windchill application process. Review web server access logs for malformed or oversized requests targeting Windchill endpoints, particularly from external IP addresses.

Recommended actions:

1. Apply PTC's patches immediately — releases began 17 June 2026. Check the official PTC advisory for version-specific guidance.
2. If patching is not immediately possible, restrict external network access to Windchill servers and place them behind a firewall or VPN.
3. Review PTC's published indicators of compromise and run them against your logs now, before completing the patch.

Security expert Richard Bejtlich has published a free practical guide on network detection and response (NDR) — the discipline of monitoring traffic moving inside your network, not just at its edges — in partnership with Corelight, according to The Hacker News.

The core argument is worth understanding. Alerts tell you something may have happened. Network evidence tells you what actually did. Bejtlich calls this interdiction: catching attackers after they get in but before they achieve their goal. Today's phishing campaign targeting hotels is a perfect example — the implant was already running before any alert fired.

If you manage a small network, the practical takeaway is this: start logging outbound traffic, not just inbound. Unusual connections to unfamiliar IPs on non-standard ports are often the first real sign of compromise. The free guide is available via the link above.

Microsoft has quietly extended its free Windows 10 Extended Security Updates (ESU) programme for personal devices through to 12 October 2027, with no formal press announcement — the change appeared as an editor's note in existing documentation, according to Bleeping Computer.

If you are still running Windows 10 at home and cannot yet upgrade, you can stay enrolled in the free ESU programme by backing up your Windows settings to a Microsoft account. One licence covers up to ten personal devices. This does not apply to workplace machines managed through corporate IT systems.