Banking Malware Maverick and Coyote Linked via WhatsApp
Threat hunters have uncovered similarities between banking malware Coyote and Maverick, both targeting users and banks in a specific region. Both malware strains are written in .NET and feature identical functionality to decrypt banking URLs and monitor banking applications. Maverick, attributed to a threat actor dubbed Water Saci, spreads through WhatsApp Web and monitors active browser tabs for financial institution URLs. The malware establishes contact with a remote server to fetch commands and steal credentials. Cybersecurity firms have noted code overlaps between Maverick and Coyote, suggesting a possible evolution or shared development.
Latest mentioned: 11-11
Earliest mentioned: 11-11