Coyote
Coyote is a Windows banking trojan primarily targeting users in Brazil. First reported in February 2024, it was initially distributed as a Windows application updater built with the Squirrel installer framework. Reported infection chains include a Squirrel-based installer launching a Node.js/Electron application with obfuscated JavaScript, staging signed binaries, using DLL sideloading involving libcef.dll, and a Nim-based loader that unpacks a final-stage .NET payload for in-memory execution via the CLR. Later reporting also links Coyote-related activity to malicious LNK files and multi-stage PowerShell delivery chains.
Coyote targets users of more than 60 banking institutions, with one report citing 61 monitored Brazilian applications and another noting expansion to 1,030 sites and 73 financial institutions. It monitors running applications, browser sessions, and banking websites, then contacts its C2 when a targeted banking application or site is accessed. Its capabilities include credential theft, keylogging, screenshot capture, fake banking overlays and phishing windows, requesting bank card passwords, process termination, blocking the machine with a fake update screen, mouse control, and system shutdown. Multiple reports also state that it can harvest credentials from banks and cryptocurrency exchanges.
A notable evolution is Coyote’s abuse of Microsoft Windows UI Automation (UIA), described as the first confirmed malware known to weaponize the Windows accessibility framework in the wild to interact with victims’ browsers and extract sensitive information. Reporting also states it can serve overlays on login pages associated with financial enterprises.
Persistence mechanisms reported for Coyote include abuse of Windows logon scripts via HKCU\Environment\UserInitMprLogonScript and reuse of obs-browser-page.exe across reboots. C2 communications have been described as using SSL with mutual authentication, with an attacker-issued certificate stored as an encrypted .NET resource and decrypted via the .NET X509 library. Kaspersky reported that up to 90% of observed infections originated from Brazil and detects the malware as HEUR:Trojan-Banker.MSIL.Coyote.gen.
Coyote is repeatedly discussed alongside other Brazilian banking malware families including Grandoreiro, Mekotio, Maverick, and GoPix. Multiple sources note code and behavioral overlaps between Coyote and Maverick, with Maverick assessed by some researchers as an evolution of Coyote. Sophos and Trend Micro also reported possible links between Coyote and WhatsApp-propagated Brazil-focused campaigns such as Water Saci/SORVEPOTEL, though those links were described as under investigation or not definitive.
Known infrastructure directly mentioned in the content includes the domain cloridatosys[.]com, linked to the Coyote banking trojan, and reporting that BlackBerry published 18 domains associated with its infrastructure. Additional high-confidence indicators from the content include the registry path HKCU\Environment\UserInitMprLogonScript, the sideloading target libcef.dll, the persistence binary obs-browser-page.exe, and the detection name HEUR:Trojan-Banker.MSIL.Coyote.gen.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
The target field of the LNK file contained an obfuscated Windows command that constructed and ran an initial Base64-encoded PowerShell command.
The campaign ... seeks to trick users into executing a malicious file attached to a self-spreading message received from a previously infected WhatsApp web session. | The archive contained a malicious Windows LNK file that, when launched, initiated a series of malicious PowerShell commands.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
The target field of the LNK file contained an obfuscated Windows command that constructed and ran an initial Base64-encoded PowerShell command.
“It then runs a signed application from that directory… Several executables have been identified in use, including those associated with Chrome and OBS Studio.”
Credential Access
1 technique
Credential Access
Discovery
1 technique
Discovery
Collection
3 techniques
Collection
Command and Control
1 technique
Command and Control
IOCs tracked for this family
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Brazilian banking malware noted in 2025 as an active family involved in credential theft and fraudulent desktop banking transactions.
Referenced as an established Latin American banking trojan with similar behaviors (e.g., overlay logic, active window monitoring, LNK hijacking) to VENON.
Banking malware referenced as similar to Maverick; targets Brazilian users/banks.
Windows banking trojan variant abusing Windows UI Automation to steal banking/crypto credentials; targets Brazilian users (per summary).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.