Loading story…
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string "CDT", fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as RAR and ISO, while continuing to distribute a broad set of remote access trojans including Loda RAT, Revenge RAT, AsyncRAT, njRAT, Ozone RAT, and Vjw0rm.
Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented Loda RAT delivery through phishing documents exploiting CVE-2017-11882, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, "Rooming List Reservas para 3 Familias.docx," to Revenge RAT delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake "Card & Booking Details.docx" document to deploy XWORM and Agent Tesla, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
ThreatBook reported that TA558 began heavily using image-based steganographic payload hosting in early December 2025, hiding malicious code in image files hosted on services such as archive.org, Cloudinary, Google Drive, and IPFS-linked infrastructure. The campaign continued through April 2026, used more than 1,400 malicious image-storage URLs, and delivered malware including AgentTesla and XWorm through phishing lures and compressed archives.
In 2022, TA558 used a Spanish-language lure impersonating 155 Hotel in which a URL led to an ISO file and batch file that ultimately installed AsyncRAT.
In 2022, TA558 significantly increased campaign tempo and shifted away from macro-enabled Office documents toward URLs, RAR attachments, and ISO attachments, likely responding to Microsoft's macro-blocking changes.
In 2021, TA558 used more elaborate chains including MSG files and helper scripts; one campaign masqueraded as Unimed and installed AsyncRAT while creating a persistence task named "Spotfy."
The domain azulviagens[.]online, used to impersonate the Brazilian travel brand Azul Viagens in a Revenge RAT campaign, was reportedly registered by the attackers.
In 2020, TA558 stopped using Equation Editor exploits and moved to malicious Office documents with VBA macros, including PowerPoint template-injection chains that installed Revenge RAT.
Proofpoint observed TA558 begin using English-language room-booking lures in addition to Portuguese and Spanish themes.
Cisco Talos reported C2 communications for a Loda RAT campaign dating back to the last quarter of 2019, indicating active operations targeting South America, Central America, and the United States.
In 2019, TA558 continued using CVE-2017-11882 documents, added macro-laden PowerPoint attachments and Office template injection, and expanded some targeting beyond hospitality and tourism to business services and manufacturing.
Proofpoint began tracking TA558 as a likely financially motivated cybercrime threat actor targeting hospitality, hotel, travel, and related organizations, primarily in Latin America.
In 2018, TA558 used malicious Word attachments exploiting CVE-2017-11882 and remote template URLs to deliver malware including Revenge RAT in reservation-themed phishing campaigns.
Elastic Security Labs described a campaign using the fake document "Card & Booking Details.docx" to fetch a malicious RTF from MediaFire, execute PowerShell, establish persistence, and deploy XWORM and Agent Tesla.
Uptycs analyzed a multi-stage campaign active in Brazil that used a reservation-themed Word document, dynamic Office template injection, embedded XLSM files, and PowerShell/VBScript stages to install Revenge RAT.
Cisco Talos observed a phishing campaign delivering Loda RAT 1.1.1 through a DOCX-to-RTF infection chain exploiting CVE-2017-11882 to install a malicious MSI payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
threatbook.io
Open sourceelastic.co
Open sourceproofpoint.com
Open sourceuptycs.com
Open sourceblog.talosintelligence.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a long-running cybercrime actor tracked as **TA2541** to years of phishing campaigns against aviation, aerospace, transportation, manufacturing, and defense organizations. Cisco Talos and Proofpoint assessed the actor as likely operating from **Nigeria**, using aviation- and travel-themed lures such as fake itineraries, charter details, and regulator impersonation to trick targets into opening malicious documents or cloud-hosted payload links. The campaigns have delivered commodity remote access trojans including **AsyncRAT**, **njRAT**, **NetWire**, **WSH RAT**, **Parallax**, **AgentTesla**, **STRRAT**, **Imminent Monitor**, and **vjw0rm**, with recurring infrastructure and identifiers such as dynamic DNS domains and keywords including **"kimjoy," "h0pe,"** and **"grace."** The intrusion chains evolved over time but remained operationally consistent: earlier waves used macro-enabled Word files, while later activity shifted to **Google Drive**, **OneDrive**, and **Discord** links hosting VBS payloads. Talos documented more complex stages involving malicious Publisher macros, `mshta`, PowerShell, AMSI bypass code, and GitHub-hosted payloads, while Fortinet described a campaign in which a Google Drive-delivered VBS script dropped XML with inline C# code, used **MSBuild.exe** for execution, and hollowed **RegSvcs.exe** to inject **AsyncRAT**, likely with ties to **Snip3 Crypter** infrastructure. Despite limited technical sophistication, the actor has maintained multi-year access operations that enable credential theft, fraud, and potential access brokerage across aviation-related targets.
Aug 15, 2026
Attackers are impersonating **Booking.com** pages in an ongoing **ClickFix** phishing campaign targeting the hospitality sector, tricking users into opening the Windows Run dialog and pasting attacker-supplied PowerShell that installs remote-access malware. Recent waves used Booking.com-branded lures such as `secure-extranet[.]com`, redirectors including `jskeowgo[.]com`, and additional phishing subdomains aimed at hotel staff, with some activity specifically targeting Italian-speaking users. Researchers observed multiple payload paths: one chain deployed **NetSupport RAT** through a large PowerShell stage that unpacked 14 base64-encoded components and then opened the legitimate Booking.com site to preserve the pretext, while another used staged loaders, ZIP delivery, and DLL sideloading via a legitimate `psl.exe` binary to install **zgRAT** and **PureHVNC**. The malware provided full remote-control capability, including shell access, file transfer, keylogging, screen capture, and webcam or audio access, and established persistence through mechanisms such as Startup-folder shortcuts and `HKCU\Run` keys like `SystemUpdate_<VID>`. Infrastructure linked to the activity included freshly registered domains obtained in batches through Chinese and Hong Kong registrars, rotating download servers, telemetry endpoints that tracked installation progress per victim, and command-and-control systems hosted across providers in Frankfurt, Russia-linked environments, and a likely bulletproof-hosting setup tied to a newly created autonomous system. Investigators also found OPSEC clues including an exposed RDP certificate leaking the hostname `WIN-FLJTJKL01VM`, a PDB path referencing `C:\Users\Administrator\Desktop\HTCTL32\`, and malware signed with a stolen `*.dodo.com` wildcard certificate, supporting clustering of the campaign as a financially motivated cybercrime operation using commodity RAT tooling.
Jun 29, 2026
Microsoft reported an active phishing campaign targeting hotel and hospitality organizations across Europe and Asia, using booking-, complaint-, and photo-themed emails to pressure recipients into opening malicious ZIP archives. The messages were routed through trusted services including Calendly and Google redirects, and in later activity used Cloudflare-fronted `.cfd` domains to evade detection. The ZIP files contained fake PNG shortcut (`.LNK`) files that launched obfuscated PowerShell, then installed a Node.js-based implant Microsoft tracks as **TonRAT**; Microsoft said the campaign has been active since April and evolved across multiple waves while keeping the same core infrastructure and tradecraft. On compromised systems, the attackers established persistence through `HKCU\Run` and `HKCU\RunOnce`, added Microsoft Defender process exclusions, and staged payloads in `Temp` and `ProgramData`, with some later samples dynamically compiling .NET DLLs via `csc.exe` and `cvtres.exe`. TonRAT communicated over encrypted WebSockets and used the TON blockchain API for command-and-control domain resolution, while Microsoft also observed beaconing on non-standard ports such as `56001` and `56002`, browser automation, geolocation lookups through `ip-api.com`, and forced shutdown commands. Microsoft has not attributed the activity to a known threat actor or confirmed follow-on ransomware or data theft, but said the operator is investing in obfuscation, persistence, and delivery evasion to maintain access for later actions.
Aug 11, 2026