Coyote malware abuses Microsoft's UI Automation to hunt banking creds

Akamai reported an in-the-wild variant of the Coyote banking trojan that is the first observed malware to abuse Windows UI Automation (UIA) to scrape credentials from browser/address bar UI elements; the variant targets Brazilian users and 75 banking and crypto web addresses, uses GetForegroundWindow and UIA to identify targets, exfiltrates credentials to a C2, and aims to drain accounts while evading detection via techniques like the Squirrel installer.