New Coyote Malware Variant Exploits Windows UI Automation to Steal Banking Credentials

Summary

Coyote malware now exploits Windows UI Automation to steal banking credentials from Brazilian users. The malware targets 75 financial institutions and cryptocurrency exchanges by parsing UI elements. This new variant can operate offline, increasing its success rate.

Key Takeaways

1. Coyote malware now exploits Windows UI Automation (UIA) to harvest sensitive information, marking the first known instance of this technique.
2. The new Coyote variant targets Brazilian users, extracting credentials linked to 75 banking institutes and cryptocurrency exchanges.
3. Coyote can perform checks, regardless of whether the malware is online or operating in an offline mode, increasing its chances of success.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article is from The Hacker News, a reputable source for cybersecurity news. It cites Akamai security researchers and Fortinet FortiGuard Labs, enhancing credibility. The claims are specific and technical, suggesting a factual basis.

Bias assessment: Technical Reporting. The article focuses on technical details of the malware and its exploitation techniques. It presents information in a neutral tone, avoiding emotional language or partisan framing. The primary goal is to inform readers about a new cybersecurity threat.

Note: This article presents technical information about a malware threat. While the source is generally credible, readers should consult additional sources for comprehensive security advice.

Credibility flag: Informative

Claimed Facts (6)

• This is presented as a factual statement about the malware's capabilities.
• This is a direct quote from a security researcher at Akamai.
• This is presented as a known fact about the malware.
• This is a factual description of UIA.
• This is a factual finding from Akamai's analysis.
• This is a factual comparison of the malware's targets.

Opinions (4)

• This is an opinion based on a demonstration by Akamai.
• This is a comparative statement, implying a similarity in tactics.
• This is an opinion on the difficulty of parsing sub-elements without UIA.
• This is an opinion on the knowledge required to read sub-elements.

Claims (2)

• While technically possible, the claim that it increases the chances of success is dubious without further evidence.
• The extent to which offline operation increases success is not quantified and could be an overstatement.

Key Sources

• Ravie Lakshmanan — Author
• The Hacker News — Media
• Tomer Peled — Akamai security researcher
• Akamai — Web infrastructure company
• Kaspersky — Cybersecurity company
• Fortinet FortiGuard Labs — Cybersecurity company