Loading story…
Hotels in Latin America were targeted with fake booking-request emails carrying malicious OpenDocument Text (.odt) attachments that delivered AsyncRAT through a multi-stage infection chain. HP Wolf Security reported that the .odt files used external OLE references to retrieve a remote Word document with embedded Excel files, which then prompted victims to enable macros. Researchers said the lures appeared in Spanish and Portuguese and found signs that similar activity had been running for months.
The attack relied on mshta.exe to proxy execution and evade suspicion, using VBA macros to launch a sequence involving PowerShell, VBScript, and batch scripts before creating a scheduled task for persistence. The use of mshta.exe aligns with the MITRE ATT&CK technique T1218.005, which documents abuse of the legitimate Microsoft HTML Application Host as a living-off-the-land binary for stealthy code execution and payload staging. HP said the malicious .odt files showed exceptionally low antivirus detection, including a reported 0% detection rate on VirusTotal at the time of analysis.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
As of 7 July 2022, HP Wolf Security reported that the malicious ODT document used in the campaign had a 0% detection rate on VirusTotal. The low detection rate distinguished it from a similar Word-based lure seen later.
In July 2022, researchers observed another malicious document campaign using the same lure image and impersonating a legitimate organization, but delivered through Microsoft Word documents instead of OpenDocument files. This Word-based lure had a much higher detection rate than the ODT-based lure.
In late June 2022, HP Wolf Security isolated a malware campaign that used fake booking-request emails and malicious OpenDocument Text files to target hotels in Latin America. The infection chain ultimately delivered AsyncRAT and used external OLE references plus macro-enabled embedded Excel content.
HP Wolf Security found evidence that related activity targeting Latin American hotels with Portuguese- and Spanish-language lures had been ongoing for several months before the late-June 2022 campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string **"CDT"**, fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as `RAR` and `ISO`, while continuing to distribute a broad set of remote access trojans including **Loda RAT**, **Revenge RAT**, **AsyncRAT**, **njRAT**, **Ozone RAT**, and **Vjw0rm**. Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented **Loda RAT** delivery through phishing documents exploiting `CVE-2017-11882`, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, **"Rooming List Reservas para 3 Familias.docx,"** to **Revenge RAT** delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake **"Card & Booking Details.docx"** document to deploy **XWORM** and **Agent Tesla**, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Aug 15, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Security researchers reported an **AsyncRAT** malware campaign that used phishing emails and HTML smuggling to deliver malicious ISO images while bypassing traditional network inspection. The lures arrived as HTML attachments disguised as receipts or order confirmations, with embedded JavaScript reconstructing a Base64-encoded ISO directly in the victim’s browser instead of downloading it from a remote server. Researchers said the activity was active from at least September 2021 and in some cases also used drive-by delivery, with the technique helping the attackers evade sandboxes, proxies, firewalls, and many antimalware engines for months. When victims opened the mounted ISO on Windows, it exposed a `.bat` or `.vbs` file that launched PowerShell, fetched or unpacked additional stages, established persistence, and executed .NET components in memory before deploying **AsyncRAT** and in some cases **NJRAT**. The campaign used multiple defense-evasion measures, including antivirus checks, Windows Defender exclusions, UAC bypass, disabling Action Center notifications, reflective DLL loading, and process injection into legitimate binaries such as `aspnet_compiler.exe` and `MSBuild.exe`; researchers also linked earlier variants to crypter-as-a-service tools including **HCrypt** and **Alosh** and warned of follow-on risks including credential theft and data exfiltration.
Aug 15, 2026