Banking Trojan Coyote Abuses Windows UI Automation

Coyote, a banking Trojan active since February 2024 in Latin America, has evolved to abuse the Windows UI Automation framework to stealthily harvest credentials and other system information from infected Windows hosts. The malware typically gains access via phishing ZIPs containing malicious .LNK shortcuts that execute PowerShell to deploy payloads, then uses UIA and other techniques (keystroke logging, screenshots, phishing overlays) to target users of dozens of banks and crypto exchanges in Brazil, evading conventional detection and highlighting the need for behavior-based defenses.