Published on: 2025-07-23

Intelligence Report: Dangerous new malware exploits Windows accessibility tools to hijack banking accounts – TechRadar

1. BLUF (Bottom Line Up Front)

A new malware, identified as Coyote, exploits Windows accessibility tools to hijack banking accounts. It primarily targets Brazilian banks and cryptocurrency exchanges by abusing the Microsoft UI Automation framework. Immediate mitigation strategies are recommended to safeguard against this threat.

2. Detailed Analysis

The following structured analytic techniques have been applied to ensure methodological consistency:

Adversarial Threat Simulation

Coyote simulates legitimate user interactions by leveraging the Microsoft UI Automation framework, allowing it to identify when a user accesses banking or cryptocurrency sites. This capability enables it to execute attacks without triggering traditional security measures.

Indicators Development

Key indicators include unusual automation of browser activities, unexpected access to banking sites, and the presence of the Coyote malware signature. Monitoring these indicators can facilitate early detection.

Bayesian Scenario Modeling

Probabilistic models suggest a high likelihood of Coyote evolving to target additional financial institutions globally. The current focus on Brazilian entities could expand, increasing the threat landscape.

3. Implications and Strategic Risks

The exploitation of accessibility tools by Coyote highlights a systemic vulnerability in Windows systems. This could lead to increased financial losses and undermine trust in digital banking platforms. The cross-domain risk includes potential impacts on economic stability and national security if financial institutions are compromised.

4. Recommendations and Outlook

• Implement enhanced monitoring of UI Automation activities within Windows environments to detect anomalies.
• Educate users on the risks of malware and encourage the use of robust password managers and two-factor authentication.
• Scenario-based projections:
  • Best Case: Rapid detection and patching of vulnerabilities limit Coyote’s spread.
  • Worst Case: Coyote evolves to target global financial systems, causing widespread disruption.
  • Most Likely: Coyote continues to target Brazilian banks while slowly expanding its reach.

5. Key Individuals and Entities

Sead (journalist), Banco do Brasil, CaixaBank, Banco Bradesco, Santander, Original Bank, Sicredi, Banco do Nordeste, Binance, Electrum, Bitcoin, Foxbit.

6. Thematic Tags

national security threats, cybersecurity, financial security, malware, regional focus, Brazil