Loading story…
Researchers reported that the Coyote banking trojan is actively targeting users, primarily in Brazil, through a multi-stage infection chain that begins with malicious Windows .lnk shortcut files. The shortcuts launch PowerShell, which in turn deploys shellcode, performs DLL-based process injection, and uses Donut-assisted payload execution before installing a final MSIL payload with registry-based persistence. Once running, Coyote conducts anti-analysis checks, fingerprints the host, communicates with command-and-control infrastructure over port 443, and supports a broad set of capabilities including keylogging, screenshots, phishing overlays, clipboard abuse, window manipulation, remote control actions, and system shutdown.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs reported identifying several similar malicious Windows LNK files over the prior month that were used in multi-stage operations delivering the Coyote Banking Trojan. The campaign targeted Windows users in Brazil and used PowerShell, shellcode, DLL injection, and registry persistence.
Akamai documented that Coyote checks active window titles and, when needed, abuses Windows UI Automation to inspect browser tabs and address bars for targeted banks and cryptocurrency exchanges. The research characterized this as the first observed malware using UI Automation in the wild for this purpose and included detection ideas involving uiautomationcore.dll and UIA-related named pipes.
Fortinet published technical details showing that this Coyote version targeted 1,030 sites and 73 financial agents, expanding beyond earlier targeting. The report also described its credential theft, keylogging, screenshot capture, phishing overlays, remote-control commands, and C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity **Casbaneiro** banking-trojan campaign is targeting Microsoft Windows users in Latin America through phishing emails masquerading as invoices and legal notices. The messages deliver a multi-stage infection chain involving an HTA downloader, an AutoIt interpreter and loader, and a final payload injected into legitimate Windows processes such as `RegSvcs.exe` or `mobsync.exe`; persistence is established through a Startup-folder LNK file. The malware activates command-and-control activity after victims visit targeted banking sites and enables financial fraud through clipboard manipulation and fraudulent windows. It also harvests Outlook address-book data and email metadata, sending it unencrypted to multiple attacker-controlled data-receiving servers. Casbaneiro evades analysis through fragmented runtime string decryption and HTTP 403 responses, while avoiding systems configured in German, French, or English; defenders should prioritize blocking the campaign's published malicious domains, IP addresses, and file hashes and investigate suspicious HTA, AutoIt, and Startup-folder activity.
Sep 16, 2026
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026
Elastic Security Labs disclosed **TCLBANKER**, a Brazilian banking trojan assessed as a major evolution of the **MAVERICK/SORVEPOTEL** family, delivered through a trojanized MSI installer for Logitech's signed **Logi AI Prompt Builder** and executed via DLL sideloading. The malware targets **59** Brazilian banking, fintech, and cryptocurrency services, using anti-analysis checks, environment-gated payload decryption, ETW patching, watchdog functions, and .NET Reactor-protected modules to evade detection and maintain execution. Once active, it monitors browser activity through UI Automation and opens a WebSocket command-and-control channel when victims visit monitored financial sites. The malware's fraud tooling includes a **WPF full-screen overlay** framework that can present fake login prompts, counterfeit Windows Update screens, vishing wait pages, and screen-capture-resistant overlays to steal credentials and support operator-driven account takeover. A separate worm component propagates through **WhatsApp Web** by hijacking authenticated browser sessions and through **Microsoft Outlook** by using COM automation to send phishing emails from the victim's own account. Researchers said the campaign relies heavily on **Cloudflare Workers** for payload hosting and C2, and appears to be in an early operational stage based on exposed developer artifacts and unfinished phishing infrastructure.
Jun 29, 2026