New Coyote Malware Variant Exploits Windows UI Automation to Steal Banking Credentials
The Coyote banking trojan for Windows is the first known malware strain to gather private data by taking advantage of the UI Automation (UIA) accessibility technology in Windows.
According to an investigation by Akamai security researcher Tomer Peled, the new Coyote variant targets Brazilian users and leverages UIA to collect credentials associated with the websites of 75 banking institutions and cryptocurrency exchanges.
First made public by Kaspersky in 2024, Coyote is notorious for focusing on Brazilian users. It has the ability to record keystrokes, take screenshots, and place overlays on top of financial company login sites.
A valid feature provided by Microsoft, UIA is a component of the Microsoft.NET Framework that enables programmatic access to desktop user interface (UI)...