Hospitality

RevengeHotels 2025: AI-Fueled VenomRAT Breach Hits Hospitality Sector

In the summer of 2025, the RevengeHotels cybercrime group (also tracked as TA558) significantly escalated its campaigns targeting the hospitality sector across Latin America, especially Brazil. Leveraging large language models (LLMs) to dynamically generate phishing lures and scripted malware loaders, the attackers delivered new VenomRAT payloads via sophisticated, invoice-themed phishing emails. These emails led hotel staff to malicious websites that dropped JavaScript and PowerShell-based loaders, ultimately granting persistent remote access for data theft and lateral movement. The attack exploited evolving tactics such as anti-kill mechanisms, registry persistence, custom encryption, and use of AI-generated code to evade detection. This incident demonstrates a marked evolution in attacker methodology, combining commodity malware, AI-driven code generation, and targeted social engineering. Such developments highlight how AI is accelerating the sophistication and reach of cyber threats, particularly in sectors with high-value payment data and limited security resources.

• Leisure/Travel
• Financial Services
• Information Technology/IT

8 months ago