Coyote: New data-stealing banking malware accounts for 90% of cases in Brazil

Security company Kaspersky has found new banking malware attacking mostly in Brazil. This JackalA threat that uses sophisticated methods to evade security plans.

According to Kaspersky’s research, More than 60 banking institutions are potential targets of this attack. Besides, Approximately 90% of attacks recorded using this method were linked to BrazilThis means that the malware focuses mainly on national victims.

This malicious tool aims to: Stealing sensitive information entered by the user into the browser. It is specifically aimed at banking websites and applications. Looks for details like logins, passwords and access keys of these institutions.

How does Coyote work?

Once downloaded and run by the victim in the initial stage of infection, Coyote disguises itself as a simple installer. It mostly goes after older machines with outdated operating systems or fewer security schemes.

This is the key feature of this type of threat known as the Trojan horse (“Trojan horse”), based on the default disguise strategy used in Ancient Greece.

But instead of acting like a normal program, Coyote Uses a program update and installation tool called Squirrel. It is more complex and less targeted by security platforms, which helps camouflage malware.

Only after hiding behind legitimate libraries does the malware actually download malicious files to the machine. It lies in wait like a wild animal for its prey and begins monitoring the victim’s activities until the time comes.

Using SSL channels, Coyote is able to communicate with the cybercriminals’ server using encrypted messages. Through these methods, it sends data collected from banking websites, including screenshots.

Now, There are no details about who was responsible for Coyote or how many people were victims.. But evidence suggests that it was indeed aimed at the Brazilian market and was even created there.

You can read Kaspersky’s full technical report, which explains this new banking threat step by step, from this link (in English).