Coyote: A multi-stage banking Trojan abusing the Squirrel installer

The developers of banking Trojan malware are constantly looking for inventive ways to distribute theirs implants and infect victims. In a recent investigation, we encountered a new malware that specifically targets users of more than 60 banking institutions, mainly from Brazil. What caught our attention was the sophisticated infection chain that makes use of various advanced technologies, setting it apart from known banking Trojan infections.

This malware utilizes the Squirrel installer for distribution, leveraging NodeJS and a relatively new multiplatform …

abusing attention banking banking trojan brazil caught developers implants infect infection infection chain installer institutions investigation malware squirrel stage trojan