Massive Phishing Campaign Strikes Latin America: Venom RAT Targeting Multiple Sectors

TA558 has been linked to a widespread phishing and malvertising campaign targeting hotel, travel, finance, manufacturing, government and other sectors across Latin America, the U.S., Europe and elsewhere to deploy Venom RAT (a Quasar RAT fork). The adversary uses phishing emails and VAST-based video ad redirects with client/server fingerprinting, and researchers note increased use of loaders like DarkGate and other malvertising groups (e.g., ScamClub) to deliver RATs, info-stealers and other payloads.