Cybersecurity experts are alerting the public about a novel malware targeting sensitive banking data using Microsoft technologies. According to a statement by Akamai Technologies, a variant from the Coyote malware family has been detected leveraging Microsoft’s UI Automation (UIA) framework for malicious purposes. This development raises concerns among security researchers about potential risks to both banking and cryptocurrency users.
Characteristics of the New Malware Variant
Unlike known malware, this new Coyote variant uses Microsoft’s UIA framework for data collection. Akamai’s security researcher, Tomer Peled, confirms that the malware employs UIA in its operations, posing a significant threat to the banking sector.
“Coyote now incorporates UIA as part of its operation. Similar to other malware, Coyote searches for banking information. However, its use of UIA differentiates it from others,” states Tomer Peled.
Researchers note that this version of Coyote specifically targets users in Brazil. By leveraging UIA, it aims to capture user information related to 75 different banks and cryptocurrency platforms.
“Even when offline, Coyote can perform control operations, thereby increasing the risk of identifying bank or cryptocurrency accounts and stealing login credentials,” adds Tomer Peled.
Coyote Viruses
The Coyote malware family was first detected in February 2024, primarily targeting institutions in Latin America. Designed to steal both banking and cryptocurrency information, Coyote operates through phishing layers and keyloggers.
Squirrel, a loader, facilitates the spread of this malware, making it easier for cybercriminals to infiltrate systems. Particularly in Brazilian-targeted campaigns, Coyote has been used to deploy remote access malware.
Cybersecurity experts highlight that Coyote’s use of the UIA framework allows easy parsing of target application subcomponents, automating the information collection process. The security community suggests that this new method could become a model for other malware families.
Coyote and similar threats present significant security risks to the financial sector and digital currency exchanges. The misuse of Microsoft’s UI Automation technology demands a reevaluation of existing defense mechanisms in cybersecurity. Users should only install software from reliable sources and be cautious about unknown file attachments. Organizations can mitigate risks by timely system updates and educating personnel about such malware threats.
