Loading malware…
TONResolver is a JavaScript-based remote access trojan used as an initial-access and persistence foothold in phishing campaigns targeting hospitality organizations, particularly Booking.com partner properties in Japan. It has been delivered through ZIP archives containing shortcut files disguised as images, with execution chains that invoke PowerShell, deploy a local Node.js runtime, and launch the obfuscated JavaScript payload via node.exe. Campaign reporting also describes both bulk phishing and trust-building conversational phishing using guest complaint and review-request lures.
A defining feature of TONResolver is its use of The Open Network (TON) blockchain as a dead drop resolver for command-and-control discovery. Rather than hardcoding infrastructure, the malware queries a TON smart contract through the get_domain method and retrieves the current C2 domain dynamically. This design allows operators to rotate infrastructure without rebuilding the malware and increases resilience against blocking and takedown.
TONResolver employs VM-based obfuscation with a custom virtual-machine-style interpreter to hinder static analysis. On execution it performs duplicate-instance checks using process logic and a mutex, establishes persistence through the current-user Windows Run mechanism, fingerprints the host, and verifies network connectivity before resolving and contacting its active C2. Communications with the operator are maintained over encrypted WebSocket sessions using ECDH on secp256k1 with HKDF-SHA256 and AES-256-CBC. Observed tasking includes arbitrary JavaScript execution, PowerShell command execution, and retrieval and execution of additional payloads.
The malware has been associated with follow-on activity consistent with credential theft and broader post-compromise operations. Observed behavior includes access to browser data stores associated with Google Chrome and Microsoft Edge, suggesting theft of stored credentials, cookies, browsing history, autofill data, and bookmarks. Interaction with LSASS has also been reported, indicating likely escalation of credential access objectives after initial compromise. Overall, TONResolver functions as a flexible Windows backdoor and staging implant designed to maintain access, receive remote commands, and support subsequent theft or deployment activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files.
The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The PowerShell command embedded in the LNK file handles two large integers... reconstructing the destination domain. The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The JavaScript file executed with arguments by node.exe (detection name: TrojanSpy.JS.TONRESOLVER.A) was identified as malware functioning as a remote access trojan (RAT).
This RAT malware employs VM-based obfuscation, making it impossible to reveal details through pure static analysis alone.
the infection began when the user clicked a shortcut link file (LNK) disguised as a photo file within the zip archive.
Starting from the node.exe process loaded with TONResolver, an executable was deployed... and further execution was found to have attempted credential theft.
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Transmission of endpoint information... includes the endpoint's username, hostname, as well as OS, CPU core count, memory information, and MAC address hardware information.
The deployed executable was observed performing operations on the following folders... C:\Users\<UserName>\AppData\Local\Google\Chrome\User Data\ ... Microsoft\Edge\User Data\
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Connection to C&C domain via WebSocket communication... Keepalive every 20 seconds... Command reception from C&C server
dead drop resolver (DDR) is any mechanism where malware fetches its command and control (C2) address at runtime from a third-party, cyberattacker-controlled location instead of hardcoding it. | The loader posts JSON-RPC to the same high-reputation crypto SaaS hosts that wallets and decentralized applications use (Infura, Cloudflare, Binance, publicnode), so host-only network signatures drown in false positives.
the malware abuses The Open Network (TON) blockchain platform as a dead drop resolver... By storing the C&C server domain in a TON smart contract, attackers can swap in a new server at any time
If Node.exe does not exist, “node-v24.13.0-win-x64.zip” is retrieved from the official Node.js website... The Base64 string... is decrypted... to generate the JavaScript payload.
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware/tooling that uses TON blockchain DNS smart-contract get_domain calls as a dead drop resolver to obtain a C2 domain, with operators able to rotate the value over time.
A JavaScript-based remote access trojan used in phishing attacks against Japan’s hospitality sector. It uses the TON blockchain as a dead drop resolver by querying a TON smart contract to obtain its current C2 domain, enabling operators to rotate infrastructure without modifying the malware. It gathers host information, maintains persistent connectivity, steals browser-stored credentials and data, deploys via PowerShell and Node.js, and persists via a Windows Run registry key.
A blockchain-enabled malware implant used in phishing campaigns targeting Booking.com partner accommodations, primarily in Japan. It abuses The Open Network (TON) blockchain as a dead drop resolver to dynamically obtain C2 infrastructure, establishes persistent keepalive/backdoor access, enables command execution, and appears to support selective follow-on compromise including potential credential theft through additional payload deployment.
Malware used in phishing campaigns targeting Booking.com partner hotels in Japan. It provides initial access, supports command execution, enables credential theft, and uses TON smart contracts to rotate or replace blocked command-and-control domains dynamically.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.