All news with #venom rat tag
Wed, September 17, 2025
TA558 Deploys AI-Generated Scripts to Install Venom RAT
⚠️Kaspersky tracked TA558, operating under the cluster known as RevengeHotels, using AI-generated JavaScript and PowerShell loaders in summer 2025 to deliver Venom RAT to hotels in Brazil and Spanish-speaking markets. Phishing emails in Portuguese and Spanish used reservation and job-application lures to coax users into running a WScript payload that chains to a PowerShell downloader fetching 'cargajecerrr.txt' and subsequent loaders. The Venom RAT, based on Quasar, includes data-stealing, reverse-proxy, persistence and aggressive anti-kill features aimed at harvesting payment card data from hotel systems and OTAs.