Monetary establishments in Latin America are being threatened by a banking trojan known as Mekotio (aka Melcoz).
That is in response to findings from Development Micro, which mentioned it just lately noticed a surge in cyber assaults distributing the Home windows malware.
Mekotio, recognized to be actively put to make use of since 2015, is thought to focus on Latin American nations like Brazil, Chile, Mexico, Spain, Peru, and Portugal with an goal to steal banking credentials.
First documented by ESET in August 2020, it is a part of a tetrade of banking trojans focusing on the area Guildma, Javali, and Grandoreiro, the latter of which was dismantled by legislation enforcement earlier this 12 months.
“Mekotio shares widespread traits for the sort of malware, akin to being written in Delphi, utilizing faux pop-up home windows, containing backdoor performance and focusing on Spanish- and Portuguese-speaking nations,” the Slovakian cybersecurity agency mentioned on the time.
The malware operation suffered a blow in July 2021 when Spanish legislation enforcement businesses arrested 16 people belonging to a prison community in reference to orchestrating social engineering campaigns focusing on European customers that delivered Grandoreiro and Mekotio.
Attack chains contain the usage of tax-themed phishing emails that goal to trick recipients into opening malicious attachments or clicking on bogus hyperlinks that result in the deployment of an MSI installer file, which, in flip, makes use of an AutoHotKey (AHK) script to launch the malware.
It is price noting that the an infection course of marks a slight deviation from the one beforehand detailed by Verify Level in November 2021, which made use of an obfuscated batch script that runs a PowerShell script to obtain a second-stage ZIP file containing the AHK script.
As soon as put in, Mekotio harvests system data and establishes contact with a command-and-control (C2) server to obtain additional directions.
It is foremost goal is to siphon banking credentials by displaying faux pop-ups that impersonate legit banking websites. It could possibly additionally seize screenshots, log keystrokes, steal clipboard knowledge, and set up persistence on the host utilizing scheduled duties.
The stolen data can then be utilized by the risk actors to achieve unauthorized entry to customers’ financial institution accounts and carry out fraudulent transactions.
“The Mekotio banking trojan is a persistent and evolving risk to monetary techniques, particularly in Latin American nations,” Development Micro mentioned. “It makes use of phishing emails to infiltrate techniques, with the aim of stealing delicate data whereas additionally sustaining a powerful foothold on compromised machines.”
The event comes as Mexican cybersecurity agency Scitum disclosed particulars of a brand new Latin American banking trojan codenamed Crimson Mongoose Daemon that, just like Mekotio, makes use of MSI droppers distributed through phishing emails masquerading as invoices and tax notes.
“The principle goal of Crimson Mongoose Daemon is to steal victims’ banking data by spoofing PIX transactions by means of overlapping home windows,” the corporate mentioned. “This trojan is aimed toward Brazilian finish customers and staff of organizations with banking data.”
“Crimson Mongoose Daemon has capabilities for manipulating and creating home windows, executing instructions, controlling the pc remotely, manipulating net browsers, hijacking clipboards, and impersonating Bitcoin wallets by changing copied wallets with those utilized by cybercriminals.”
