Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered a new wave of cyberattacks by the long-active group RevengeHotels, which between June and August 2025 targeted hotels in Brazil and Malaysia to steal guests’ payment details. The group, operating since 2015, has now upgraded its methods by using artificial intelligence to generate sophisticated malicious code, making phishing emails harder to detect.
Once hotel staff interact with these convincing fake invoices or job applications, malware such as VenomRAT is installed, giving attackers access to sensitive guest data. While Brazilian hotels remain the primary focus, incidents have also been reported in Argentina, Bolivia, Chile, Costa Rica, Mexico, Spain, and previously in Malaysia, Russia, Turkey, Italy, and Egypt.
Kaspersky urges both organisations and travellers to exercise extra caution with unexpected emails and adopt advanced security solutions to guard against evolving AI-driven threats.
