TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks
Summary: Kaspersky attributed a summer 2025 campaign to TA558, tracked as RevengeHotels, delivering Venom RAT to hotels in Brazil and Spanish-speaking markets through Portuguese- and Spanish-language phishing emails with hotel reservation and job application lures. Kaspersky said much of the initial infector and downloader code, including a heavily commented WScript JavaScript payload, appears generated by large language model agents, with the chain moving through PowerShell to a downloader named cargajecerrr.txt and then to a Venom RAT loader.
What you should know: The group's objective is credit card data from guests and from online travel agencies such as Booking.com, and Venom RAT now carries an anti-kill loop that checks running processes every 50 milliseconds and terminates security tools, plus code to disable Microsoft Defender Antivirus.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2017-0199
- Related
- My Little Form Book Cyber Risks ·Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox Cyber Risks ·Paranoid PlugX Cyber Risks ·