Firm Alerts Travelers to AI-Driven Attacks on Hotel Guests

Emerging Cyber Threat: RevengeHotels and AI-Powered Attacks on Hotels

Between June and August 2025, Kaspersky’s Global Research and Analysis Team (GReAT) identified a new wave of cyberattacks orchestrated by a threat group known as RevengeHotels. This group has been targeting hotels to steal guests’ payment information, leveraging advanced techniques that have evolved over the years.

The group has been active since 2015, continuously refining its methods. Recently, it has taken a significant step forward by incorporating Artificial Intelligence (AI) into its attack strategies. This shift has made their operations more effective and expanded their reach across different regions.

According to the analysis conducted by Kaspersky, many of the latest malicious programs used in these attacks contain code that is likely generated using AI. This development makes the malware more sophisticated and harder to detect, posing a serious challenge for cybersecurity professionals.

Although Brazil has been the primary target so far, similar cyberattacks have also been reported in other countries around the world. Given that countries in Africa, such as South Africa and Kenya, are popular tourist destinations, and Nigeria is a major hub for business travel, it is crucial to recognize that no hotel or country is completely immune to these threats.

How the Attacks Work

The threat actor employs a variety of tactics to infiltrate hotel systems. One common method involves sending phishing emails directly to hotel staff. These emails are often disguised as requests for reservations or job applications, making them appear legitimate. Once an employee interacts with these emails, malware called VenomRAT is installed on the hotel's systems. This malware provides attackers with access to guests' payment data and other sensitive information.

The emails sent by the threat group are designed to look convincing, often originating from websites that appear to be legitimate. This level of sophistication makes it difficult for even trained individuals to distinguish between genuine communications and malicious ones.

Impact on Hotel Guests

The implications of these attacks extend beyond the hotel industry itself. For hotel guests, the risk of card and personal data theft is increasing. Even when travelers trust well-known hotels, they may still be vulnerable to these sophisticated cyber threats.

Lisandro Ubiedo, an expert at Kaspersky’s Global Research and Analysis Team, highlighted the growing use of AI by cybercriminals. He stated, “Cybercriminals are increasingly using AI to create new tools and make their attacks more effective. This means that even familiar schemes, like phishing emails, are becoming harder to spot for a common user.”

This trend underscores the need for heightened awareness and improved security measures within the hospitality sector. Hotels must invest in robust cybersecurity protocols to protect both their operations and their guests' sensitive information.

The Need for Enhanced Security Measures

As the threat landscape continues to evolve, it is essential for hotels to stay ahead of potential cyber threats. Implementing advanced detection systems, training staff to recognize suspicious activities, and regularly updating software can help mitigate the risks associated with these attacks.

Moreover, collaboration between cybersecurity experts, hotel management, and regulatory bodies is crucial in developing comprehensive strategies to combat emerging threats. By working together, the industry can better protect its guests and maintain trust in the services it provides.

In conclusion, the rise of AI-powered cyberattacks like those carried out by RevengeHotels highlights the importance of vigilance and proactive measures in the hospitality sector. As technology continues to advance, so too must the defenses against those who seek to exploit it.