The Coyote banking trojan has become the first known malware to exploit Windows UI Automation framework to steal banking credentials. Active since February 2024, it targets users of 75 banks and crypto exchanges in Brazil by using the accessibility framework to extract sensitive information from browser tabs and address bars. The malware operates both online and offline, continuously searching for banking-related content and sending data to command-and-control servers. This represents a significant evolution in malware tactics, as attackers abuse legitimate Windows features to evade detection while maintaining persistent access to victim systems.
Sort: