RevengeHotels Strikes Back: AI-Generated Phishing and a New RAT Target Hotels

RevengeHotels, also tracked as TA558, has resurfaced with a new campaign targeting hotels and the wider hospitality sector, extending its long-running fraud of stealing card data from guests. The latest campaigns observed in summer 2025 rely on phishing emails—often themed around invoices or overdue payments—but the loader code is now largely generated by large language models, with AI-enhanced scripts that are cleaner and easier to tailor.

Victims clicking malicious links are redirected to fake document storage sites that drop a PowerShell payload after decoding a JavaScript loader named in Portuguese as Fat{NUMBER}.js, with the final payload delivering VenomRAT, an advanced RAT derived from QuasarRAT that offers HVNC, credential and file theft, a reverse proxy, anti-kill protection, and persistence via registry keys.

Kaspersky describes the final implants as enabling commands to control systems, steal data, and maintain persistence, and notes that the malware includes evasion techniques such as anti-kill measures and Windows Defender disabling. While Brazilian hotels are still the main targets, campaigns are broadening into Latin America and Spanish-speaking markets, including Argentina, Mexico, Chile, Costa Rica and Spain, according to the source.