Malware / business emailEmail
Fake angry guest complaint emails with malware 'photos'
Last updated
Also known as: Hotel guest complaint LNK malware, Fake review email remote-access trojan
What it looks like
Emails to hotel staff that look like angry guest complaints or negative reviews and link to a "photo" or similar attachment. The file is actually a Windows shortcut (.lnk) that installs remote-access malware. Messages appear likely AI-written and can sometimes land inside real email threads.
Who it targets
Hotel and accommodation staff (front desk, reservations, guest relations).
Red flags
- Urgent guest complaint urging you to open a photo or video
- Attachment or download that is a shortcut (.lnk) posing as an image
- Odd wording that may be AI-generated
- Unexpected complaint arriving as a reply in a real thread
What to do if you clicked, paid, or replied
- Do not open the attachment or click the "photo" link
- Report the message to your IT / security team
- Treat unsolicited complaint emails with the same caution as other phishing
- If you opened a file, disconnect and follow your organization's incident process
Still circulating?
Cofense October 2026 report on campaigns targeting the accommodation industry.
Primary source: Cofense · 2026-10-07
Educational summary only. Verify details on the source page. Report fraud at ReportFraud.ftc.gov or ic3.gov.