Researchers Expose Deep Connections Between Maverick and Coyote Banking Malware

Security researchers at CyberProof have uncovered strong connections between two Brazilian-targeting banking trojans, Maverick and Coyote, which are active through WhatsApp. The findings followed a suspicious file download incident from WhatsApp that prompted a broader threat analysis and cross‑referencing with public research from firms including Kaspersky, Sophos and Trend Micro, which supported the link between the families.

Both malwares spread via WhatsApp and use identical infection chains beginning with shortcut (.lnk) files that spawn PowerShell processes in multi‑stage attacks, with the same encryption methods to decrypt banking URLs and near‑identical routines for monitoring banking applications.

They are written in .NET and specifically target Brazilian financial institutions such as Bradesco, Banco do Brasil and Itaú, as well as cryptocurrency exchanges like Binance and Foxbit; early activity includes an outbound connection to 109.176.30[.]141.

The attack chain employs obfuscated PowerShell commands, including Base64 and UTF‑16LE encoding, and after loading, download second‑stage payloads, turn off Microsoft Defender protections and disable UAC before a .NET loader performs further steps, including modules to hijack WhatsApp Web sessions and steal banking information.

CyberProof has released a hunting query to help SOC teams identify suspicious WhatsApp‑origin downloads linked to PowerShell execution, emphasising the need for endpoint protection, application whitelisting and behavioural analysis to defend Brazilian‑focused campaigns.