A new malware campaign dubbed TONResolver targets Japanese hotel staff who are Booking.com partners via phishing emails impersonating guest complaints. The attack chain begins with a malicious LNK file inside a ZIP archive, which executes PowerShell to download a Node.js-based JavaScript RAT. The malware's key innovation is using the TON (The Open Network) blockchain as a dead drop resolver: the C&C server domain is stored in a TON smart contract and can be swapped at any time, making takedowns ineffective. The RAT uses VM-based obfuscation, ECDH key exchange, and AES-256-CBC encryption over WebSocket for C&C communication. Once installed, it maintains a Keepalive loop awaiting commands, with observed follow-on activity including credential theft from Chrome and Edge browser data. Two delivery methods were observed: bulk phishing and conversational Gmail-based attacks that build trust before delivering a malicious URL. Mitigations include blocking access to tonapi.io, restricting PowerShell external communications, and monitoring for anomalous Node.js usage.
