Windows Users Hit by VenomRAT in AI-Driven RevengeHotels Attack

RevengeHotels, also known as TA558, has escalated its long‑standing cybercrime campaign by incorporating artificial intelligence into its infection chains, deploying VenomRAT against Windows users. Active since 2015, the threat actor has historically targeted hotel guests and travellers, stealing payment card data through phishing emails, but recent campaigns use AI-generated loader scripts and modular JavaScript and PowerShell downloaders to deliver VenomRAT implants with enhanced stealth, persistence and control.

The latest wave begins with customised phishing emails themed around overdue invoices or fraudulent job applications sent to hotel reservation and HR addresses; recipients clicking the embedded link are redirected to attacker‑controlled pages that automatically download a WScript JS file named in the format Fat{NUMBER}.js into the victim’s temporary folder.

The loader scripts are highly modular and include placeholders for dynamic variables, with in-memory execution of a PowerShell file named SGDoHBZQWpLKXCAoTHWdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1. VenomRAT offers features such as HVNC, reverse proxy and robust encryption, and it can propagate via removable media as “My Pictures.exe” to USB drives, while clearing Windows event logs to obscure activity. Targeting focuses on Brazilian hotels, expanding to Spanish-speaking markets such as Mexico, Chile and Argentina.