Between June and August 2025, Kaspersky’s Global Research and Analysis Team (GReAT) discovered a new wave of cyberattacks by a threat group called RevengeHotels, which targets hotels to gain access to guests’ payment information. The group has been operating since 2015 and has since upgraded its methods. The threat actor is now using Artificial Intelligence (AI) to make their attacks more effective and reach additional regions. Analysis shows that many of the new malicious programs used in these attacks contain code likely generated with AI, making them more sophisticated and harder to detect.
While hotels in Brazil have been the main target to date, such cyberattacks have also been reported in other countries around the globe. And considering that countries in Africa, including South Africa and Kenya, are popular tourist destinations, and Nigeria a popular business travel destination, it is important to consider that no country or hotel is immune to falling victim.
How the attacks work
The threat actor sends phishing emails directly to hotel staff, often disguised as requests for reservation or job applications. Once a hotel employee interacts with these emails, malware called VenomRAT is installed on the hotel’s systems, giving attackers access to guests’ payment data and other sensitive information. The emails often look convincing, coming from legitimate-looking websites.
“Сybercriminals are increasingly using AI to create new tools and make their attacks more effective. This means that even familiar schemes, like phishing emails, are becoming harder to spot for a common user. For hotel guests, this translates into higher risks of card and personal data theft, even when you trust well-known hotels,” comments Lisandro Ubiedo, expert at Kaspersky’s Global Research and Analysis Team.
To stay safe, Kaspersky recommends:
- Even if an email seems friendly, treat links and attachments with care. To protect your company, use solutions from the Kaspersky Next (https://apo-opa.co/4pCbVny) product line that provide real-time protection, threat visibility, investigation and response capabilities of EDR and XDR for organisations of any size and in any industry.
- Cybercriminals often distribute fake email messages mimicking email notifications from an online store or a bank, luring a user to click on a malicious link and distribute malware. If attackers are specifically targeting your organisation, the email text may be more customised, mimicking services or scenarios familiar to your company. With that in mind, fine-tune your antispam settings and never open attachments sent by an unknown sender.
- Try not to open unexpected files sent by you massively. They may be ransomware or even spyware, even attachments from official-looking emails.
Africa Fact: Africans carved the world’s first colossal sculpture 7,000 or more years ago. The Great Sphinx of Giza was fashioned with the head of a man combined with the body of a lion. A key and important question raised by this monument was: How old is it? In October 1991 Professor Robert Schoch, a geologist from Boston University, demonstrated that the Sphinx was sculpted between 5000 BC and 7000 BC, dates that he considered conservative.
Bowie
Fun South African Fact: South Africa is part of BRICS.
Jack Cassidy
Some lions just escaped a nature reserve in South Africa
They were rejected from their group.
They could maybe ask to be let in the group again
But their pride wouldn\’t let them.