RevengeHotels Leveraging AI To Attack Windows Users With VenomRAT

RevengeHotels, a financially motivated threat actor active since 2015, has shifted to using large-language-model–generated JavaScript loaders and PowerShell stagers to deliver VenomRAT to hospitality networks in Latin America; the multi-stage chain decodes and writes timestamped PowerShell scripts, retrieves Base64 payloads to execute VenomRAT in memory, and leverages HVNC, file-stealing modules, UAC bypasses, encrypted/configured C2 communication, and ngrok tunneling to expose remote services—complicating detection and increasing risk to targeted organizations.