Analyzing the Link Between Two Evolving Brazilian Banking Trojans

This intelligence report examines the connection between two Brazilian banking trojans, Maverick and Coyote. The malware spreads through WhatsApp, using a multi-stage attack that begins with a malicious LNK file. Both trojans share similarities in their infection methods, targeting Brazilian users and banks. The attack chain involves obfuscated PowerShell commands, downloading additional payloads from command and control servers. The malware employs anti-analysis techniques and targets specific browsers. Persistence is achieved through a batch file in the startup folder. The report provides technical details, including code samples and infection chain analysis, as well as indicators of compromise for the identified malware campaign.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• Investigating a Multi-Stage PowerShell LoaderCampaign2026-08-10
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13