Going on a trip this holiday season? Here’s how you can stop 'RevengeHotels' malware from stealing your data

A lot can go wrong with holiday plans. Airline tickets have to be booked, conveyance arranged, and hotel reservations made. Even if things fall into place, the flight could be delayed, or worse, postponed. The driver of your cab may be late, prompting an excruciating wait at the airport.

A delay notwithstanding, one is given to feeling relieved when one’s cab purrs into the porch of the hotel. The check-in process goes smoothly. The concierge was sympathetic. The bellhop unloads your luggage from the car and trundles it to the elevator. You are shown to your room. It is not altogether different from what was advertised online. All is well.

However, when you are lounging in your king-size bed and flipping through the channels after your long and arduous journey, hackers could be siphoning off money from your bank account. The cybersecurity firm Kaspersky detected a new malware campaign dubbed ‘RevengeHotels’ that targets the hospitality sectors.

The epicenter of the malware attack has been hotels in Brazil. But computers in other tourist hotspots like Spain, Turkey, Portugal, Thailand, Italy, Mexico, France, Chile, Costa Rica, Argentina, and Bolivia have also been found to be infected by ‘RevengeHotels.’

The newly detected malware attack targets the front desks of hotels around the world. The main objective is to steal credit card data from guests that are stored in the in-houses database management system of the hotel. Travel agencies are also not spared, and according to Kaspersky, the malware has had success in extracting credit card data from companies like Booking.com.

The malware spreads through emails that have malicious attachments in the form of Word, PDF, or Excel files. The group which created the campaign has been active since 2015, but the number of attacks picked up only in the past few months. Researchers at Kaspersky have identified two groups, both of which used similar tools and infrastructure named ProCC and Revenge Hotels respectively.

These groups extract credentials linked to bank accounts, and sell them for a fee. Moreover, they gain control over the affected system, enabling other hackers to gain remote access to front desks at hotels that are already infected with malware.

"We monitored the activities of these groups and the new malware they are creating for over a year. With a high degree of confidence, we can confirm that at least two distinct groups are focused on attacking this sector; there is also a third group, though it is unclear if its focus is solely on this sector or if carries out other types of attacks," Kaspersky said in its blog post.