RevengeHotels is a financially motivated cybercriminal group that emerged in 2015, specializing in targeting the hospitality sector, specifically hotels, hostels, and tourism companies. Their primary motivation is the financial gain derived from stealing guest credit card data and hotel administration credentials. Operating predominantly from Brazil, the group has expanded its reach to numerous countries across Latin America, Europe, and Asia. Initially, the group, also known as TA558, employed spear-phishing campaigns to deliver Remote Access Trojans (RATs). A significant evolution in their operational methodology was observed in 2025, when the group began leveraging large language model generated code for creating more convincing phishing lures and evasive initial infection mechanisms. This adaptation highlights their continuous effort to refine tactics and maintain effectiveness against their niche target sector.