Experts Warn of Mekotio Banking Trojan Targeting Latin American Countries

Trend Micro reported a surge in Mekotio (Melcoz) banking-trojan activity targeting Latin American countries (Brazil, Chile, Mexico, Spain, Peru, Portugal) where attackers use tax-themed phishing to deliver MSI droppers that deploy AutoHotKey scripts; Mekotio harvests system info, contacts C2 servers and steals banking credentials via fake pop-ups while also logging keystrokes, taking screenshots, hijacking clipboards and maintaining persistence. Mexican firm Scitum disclosed a similar threat named Red Mongoose Daemon focused on Brazilian users, which also uses overlapping windows to spoof transactions and replaces copied cryptocurrency wallets.