Loading threat actor…
Coyote is a Windows banking trojan associated with credential theft against online banking users in Brazil. It is notable for being the first publicly reported malware strain known to abuse the Windows UI Automation accessibility framework to harvest sensitive information from banking applications and related user interfaces. This use of legitimate accessibility functionality allows the malware to inspect interface elements and capture data in ways that can help bypass traditional browser- or form-focused collection methods. Coyote is primarily characterized as a financially motivated banking malware family. Its observed tradecraft centers on theft of banking credentials and related sensitive user information. The malware’s abuse of trusted operating-system features reflects a defense-evasion approach that blends malicious activity with legitimate Windows functionality rather than relying solely on more conventional web-injection techniques. No high-confidence attribution to a named intrusion set or nation-state operator is established here. Likewise, no corroborated evidence is available here for ransomware, destructive activity, or broader sectoral targeting beyond banking-related theft against Brazilian users.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.