Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays

Researchers disclosed VENON, a Rust-written banking trojan targeting Brazilian Windows users that departs from regional Delphi-based families; it uses DLL side-loading, nine evasion techniques (anti-sandbox checks, indirect syscalls, ETW and AMSI bypass), retrieves configuration from Google Cloud Storage, installs scheduled tasks, maintains WebSocket C2 communications, and implements LNK shortcut hijacking and fake overlays to steal credentials from 33 financial institutions. The report also links VENON’s distribution to social-engineering lures and a PowerShell-delivered ZIP, and situates the threat amid WhatsApp-based SORVEPOTEL campaigns that have delivered other banking malware.