A new wave of cyberattacks is targeting hotels to gain access to guests’ payment information.
A threat group called RevengeHotels is using Artificial Intelligence to make their attacks more effective and reach regions beyond hotels in Brazil which have been the main target to date.
Between June and August 2025, Kaspersky’s Global Research and Analysis Team discovered that many of the new malicious programmes used in these attacks contain code likely generated with AI, making them more sophisticated and harder to detect.
While hotels in Brazil have been the main target, Kasperksky warned that no country or hotel is immune to falling victim.
How the attacks work
The threat actor sends phishing emails directly to hotel staff, often disguised as requests for reservation or job applications.
Once a hotel employee interacts with these emails, malware called VenomRAT is installed on the hotel’s systems, giving attackers access to guests’ payment data and other sensitive information.
The emails often look convincing, coming from legitimate-looking websites.
"Сybercriminals are increasingly using AI to create new tools and make their attacks more effective. This means that even familiar schemes, like phishing emails, are becoming harder to spot for a common user.
“For hotel guests, this translates into higher risks of card and personal data theft, even when you trust well-known hotels," said Lisandro Ubiedo, expert at Kaspersky’s Global Research and Analysis Team.