TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks

The threat actor TA558 has been attributed to a fresh wave of attacks delivering Venom RAT to hotels in Brazil and other Spanish-speaking markets, with Russian cybersecurity vendor Kaspersky tracking the activity in a cluster it calls RevengeHotels.

According to Kaspersky, the group continues to use phishing emails with invoice themes to deliver Venom RAT implants via JavaScript loaders and PowerShell downloaders, with a significant portion of the initial infector code reportedly generated by large language model agents.

The latest campaigns feature an AI-generated script that loads further payloads, including a PowerShell downloader that retrieves a loader and ultimately the Venom RAT, a commercial tool cited as available for $650 for a lifetime license or $350 for a one-month bundle.

Venom RAT is described as capable of siphoning data, acting as a reverse proxy, and includes an anti-kill mechanism that terminates security processes and modifies DACLs to persist, with persistence via Windows Registry and SeDebugPrivilege escalation. The attacks aim to harvest credit card data from guests and OTAs, and phish Portuguese- and Spanish-language hotel reservations to spread to new regions. The campaign marks a notable shift toward leveraging AI to bolster phishing lures and expand the reach of RevengeHotels.