The hacker group known as RevengeHotels, active since 2015, has been targeting the hospitality sector, focusing on stealing payment card data from hotel guests and front-desk systems. Recently, their campaigns have evolved to use artificial intelligence, specifically large language models (LLMs), to enhance their phishing attacks and modify their phishing lures helping expand the regions they attack. These AI-generated phishing emails, disguised as invoices or job applications, trick staff into opening malicious attachments that deploy VenomRAT. This remote access trojan, derived from QuasarRAT, is capable of stealing credentials and controlling infected systems. Kaspersky reports that RevengeHotels’ recent attacks have expanded beyond Brazil, targeting hotels in Mexico, Argentina, Chile, Costa Rica, Spain, Russia, Belarus, and Turkey. The group frequently rotates domains and payloads to evade detection, aiming to harvest sensitive traveler data globally. Additionally, the use of AI allows for more structured and detailed malicious code, a trend seen among other cybercriminal groups. In a broader context, hacker groups, including state-backed actors, are increasingly leveraging AI tools like OpenAI’s ChatGPT for various illicit activities, from generating deepfakes to refining malware. CTIX analyst recommend that concerned organizations visit Kaspersky’s report linked below for a list of campaign-related IOCs