Coyote malware uses Windows accessibility tools to steal banking credentials
Coyote malware now misuses a Windows feature designed for accessibility to spy on users and steal banking or crypto credentials.
A new cybersecurity threat is making headlines. The Coyote malware is back with a new trick up its sleeve. This time, it is using Windows tools to spy on users and steal banking details. Coyote now takes advantage of a feature called UI Automation. This feature was built to help apps support accessibility needs. But Coyote turns it into a spying device. It watches which sites you open, especially banking and crypto exchange pages.
How does it function?
When someone installs a program that carries the malware, usually delivered through the popular Squirrel installer, the Coyote malware begins working in the background. It gathers basic system information and watches which apps or windows are in use. If the user opens a bank or cryptocurrency site, the malware uses UI Automation to read what is on the screen.
Coyote can even pull web addresses straight from the browser tabs or address bar and check them against a list of banking and crypto platforms it is designed to target. If it finds a match, it attempts to extract login credentials or wallet information.
This malware primarily targets people in Brazil right now. Institutions like Banco do Brasil, Santander, and crypto exchanges like Binance are among its main targets. But this could change quickly. Many attackers use specific regions to test malware before launching wider attacks across the globe.
What makes Coyote especially dangerous is how it avoids detection. Since it relies on tools that are already part of Windows, traditional security software may not pick it up. This allows it to stay hidden and continue spying without raising suspicion.
To defend against such threats, it is important to only download software from trusted sources. Users should also ensure their systems and antivirus software are always up to date. Being cautious online and staying informed about new threats is key.
The Coyote malware is a perfect example of how cybercriminals can twist helpful technologies into tools for stealing money and information. Staying one step ahead requires vigilance and smart digital habits.
