Coyote, Maverick Banking Trojans Run Rampant in Brazil

Several security researchers have tied multiple banking Trojans, including Coyote and Maverick, to campaigns targeting Brazilian citizens this year, with CyberProof noting several waves of activity focused on WhatsApp users. According to Sophos Counter Threat Unit, victim counts have numbered in the hundreds of organisations, and in the most recent October campaign the firm responded to early-stage activity in more than 400 customer environments across more than 1,000 endpoints.

CyberProof’s analysis shows that more than 450 cases were tracked, with almost all identified infections occurring in Brazil, though incidents also appeared in manufacturing, technology, education and construction. A notable function of Maverick’s malware is that it checks whether a user is based in Brazil and self-terminates if not, illustrating highly localised targeting.

Researchers also note parallels between Coyote and Maverick, which spread via messages containing attached zip files that run a PowerShell-based multistage attack, harvesting banking and cryptocurrency secrets.