Coyote Malware Evolves: Exploiting Windows UI Automation for Banking Credential Theft

TL;DR

The latest variant of the Coyote malware targets Brazilian users by exploiting the Windows UI Automation framework to steal banking credentials from over 75 financial institutions. This new technique highlights the evolving sophistication of malware threats.

Introduction

The Coyote malware, a notorious banking trojan, has recently evolved to exploit the Windows accessibility framework known as UI Automation (UIA). This new variant specifically targets Brazilian users, aiming to harvest sensitive information from a wide range of banking institutions and cryptocurrency exchanges.

Understanding the Threat

The new Coyote variant is particularly concerning due to its innovative use of the Windows UI Automation framework. This framework is designed to assist users with disabilities by providing programmatic access to user interface elements. However, malware developers have repurposed it to extract credentials from banking websites and cryptocurrency exchanges.

Key Features of the New Variant

• Targeted Attacks: The malware primarily targets users in Brazil, focusing on over 75 different banking institutions and cryptocurrency exchanges.
• UI Automation Exploitation: By leveraging the UI Automation framework, the malware can interact with web pages and extract sensitive information without user intervention.
• Credential Harvesting: The primary goal of this variant is to steal banking credentials, allowing attackers to gain unauthorized access to financial accounts.

Impact and Implications

The use of UI Automation in malware represents a significant shift in tactics, demonstrating the increasing sophistication of cyber threats. This method allows attackers to bypass traditional security measures, making it more difficult for users and financial institutions to detect and mitigate the threat.

Expert Insights

Akamai security researcher Tomer highlights the severity of this new threat:

The new Coyote variant is targeting Brazilian users, and uses UIA to extract credentials linked to 75 banking institutes’ web addresses and cryptocurrency exchanges.

This underscores the need for enhanced security measures and user awareness to combat such advanced threats.

Conclusion

The evolution of the Coyote malware to exploit Windows UI Automation is a stark reminder of the ever-changing landscape of cybersecurity threats. Users and financial institutions must stay vigilant and implement robust security practices to protect against these sophisticated attacks.

Additional Resources

For further insights, check:

• Source Article

References