Coyote Banking Trojan Becomes First to Exploit Microsoft UI Automation in Active Attacks on Banks and Crypto Platforms

AI-suggested

European organizations should implement targeted mitigations beyond standard endpoint protection. First, restrict and monitor the use of Microsoft UI Automation APIs through application whitelisting and behavior-based detection tools to identify anomalous automation activities. Employ endpoint detection and response (EDR) solutions capable of correlating UI Automation usage with suspicious process behaviors. Harden user privileges to enforce least privilege principles, limiting the ability of malware to invoke UI Automation on critical applications. Implement multi-factor authentication (MFA) mechanisms that are resistant to UI automation manipulation, such as hardware tokens or biometric factors that require direct user interaction. Conduct regular security awareness training focused on phishing and social engineering, as initial infection vectors for banking trojans often involve user deception. Additionally, network segmentation and strict access controls can limit lateral movement if an endpoint is compromised. Finally, maintain up-to-date threat intelligence feeds and monitor for emerging indicators related to Coyote Trojan activity to enable proactive defense and rapid incident response.