Cyber threat actors are targeting employees of Booking.com partner accommodations in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. The malware delivered through this campaign, TONResolver, is hosted on a smart contract and leverages blockchain technology – specifically, The Open Network (TON) blockchain platform. It functions as an initial access and command-execution foothold, with follow-on activity indicating potential credential theft and further compromise. Phishing Emails to Booking.com Partners The campaign was detected by TrendAI Research, Trend Micro’s research unit, in late May 2026. Suspicious emails had been sent to Japanese partner companies of Booking.com, with the subject line…