Coyote Malware Evolves with WhatsApp Web Propagation

Coyote malware, initially spread through phishing in 2022, has evolved to use WhatsApp Web for propagation. By 2025, it employed sophisticated techniques like script-driven payloads and browser automation. The malware's latest iteration, Water Saci, features a modular architecture and advanced command-and-control mechanisms, highlighting the increasing sophistication of cyber threats targeting financial and messaging platforms.

Latest mentioned: 10-29

Earliest mentioned: 10-28

Sources

gbhackers.com trendmicro.com securityonline.info

Also Read

BRONZE BUTLER Exploits LANSCOPE Zero-Day for Data Theft

In mid-2025, Secureworks CTU researchers uncovered a sophisticated cyber campaign by the BRONZE BUTLER group, exploiting a zero-day vulnerability in Motex LANSCOPE Endpoint Manager. This group, active since 2010, has a history of targeting specific organizations and government entities. The vulnerability, CVE-2025-61932, allows remote attackers to execute arbitrary commands with SYSTEM privileges. The campaign involved deploying Gokcpdoor and Havoc C2 frameworks, using legitimate tools like goddi and 7-Zip for data exfiltration. International cybersecurity authorities quickly responded, highlighting the severity of the threat.

10-31Read more →