Cybersecurity researchers have disclosed particulars of a brand new banking malware focusing on Brazilian customers that is written in Rust, marking a major departure from different recognized Delphi-based malware households related to the Latin American cybercrime ecosystem.
The malware, which is designed to contaminate Home windows programs and was first found final month, has been codenamed VENON by Brazilian cybersecurity firm ZenoX.
What makes VENON notable is that it shares behaviors which might be in step with established banking trojans focusing on the area, comparable to Grandoreiro, Mekotio, and Coyote, particularly on the subject of options like banking overlay logic, lively window monitoring, and a shortcut (LNK) hijacking mechanism.
The malware has not been attributed to any beforehand documented group or marketing campaign. Nevertheless, an earlier model of the artifact, relationship again to January 2026, has been discovered to show full paths from the malware writer’s improvement atmosphere. The paths repeatedly reference a Home windows machine username “byst4” (e.g., “C:Usersbyst4…”).
“The Rust code construction presents patterns suggesting a developer acquainted with the capabilities of current Latin American banking trojans, however who used generative AI to rewrite and develop these functionalities in Rust, a language that requires vital technical expertise to make use of on the noticed stage of sophistication,” ZenoX mentioned.
VENON is distributed by way of a classy an infection chain that makes use of DLL side-loading to launch a malicious DLL. It is suspected that the marketing campaign leverages social engineering ploys like ClickFix to trick customers into downloading a ZIP archive containing the payloads by way of a PowerShell script.
As soon as the DLL is executed, it performs 9 evasion methods, together with anti-sandbox checks, oblique syscalls, ETW bypass, AMSI bypass, earlier than truly initiating any malicious actions. It additionally reaches out to a Google Cloud Storage URL to retrieve a configuration, set up a scheduled job, and set up a WebSocket connection to the command-and-control (C2) server.
Additionally extracted from the DLL are two Visible Fundamental Script blocks that implement a shortcut hijacking mechanism completely focusing on the Itaú banking utility. The elements work by changing the professional system shortcuts with tampered variations that redirect the sufferer to an internet web page below the menace actor’s management.
The assault additionally helps an uninstall step to undo the modifications, suggesting that the operation might be remotely managed by the operator to revive the shortcuts to what they initially had been to cowl up the tracks.
In all, the banking malware is provided to focus on 33 monetary establishments and digital asset platforms by monitoring the window title and lively browser area, springing into motion solely when any of the focused functions or web sites are opened to facilitate credential theft by serving pretend overlays.
The disclosure comes amid campaigns the place menace actors are exploiting the ubiquity of WhatsApp in Brazil to distribute a worm named SORVEPOTEL through the messaging platform’s desktop net model. The assault hinges on abusing beforehand authenticated chats to ship malicious lures on to victims, in the end ensuing within the deployment of banking malware comparable to Maverick, Casbaneiro, or Astaroth.
“A single WhatsApp message delivered by way of a hijacked SORVEPOTEL session was ample to attract a sufferer right into a multi-stage chain that in the end resulted in an Astaroth implant operating totally in reminiscence,” Blackpoint Cyber mentioned.
“The mix of native automation tooling, unsupervised browser drivers, and user-writable runtimes created an unusually permissive atmosphere, permitting each the worm and the ultimate payload to determine themselves with minimal friction.”
