Akamai researchers have identified the first confirmed case of malware weaponizing Microsoft’s Windows UI Automation (UIA) framework in the wild, marking a significant escalation in credential-stealing tactics targeting financial institutions.
The newly analyzed variant of the Coyote banking trojan uses UI Automation to systematically extract sensitive login credentials from users in Brazil, impacting customers of 75 banking organizations and cryptocurrency exchanges.
This development follows Akamai’s December 2024 warning about UI Automation as a potential attack vector, transitioning from proof-of-concept to active exploitation within a matter of months.
First Documented UIA Abuse by Malware
Coyote malware, initially detected in February 2024, quickly gained notoriety across Latin America for its innovative infection strategies and persistent attacks against corporate and personal endpoints.
The malware typically spreads through the Squirrel installer platform, executing a combination of keylogging and phishing overlay techniques to harvest financial data.
New research indicates that Coyote’s developers have now moved beyond traditional credential theft methods, leveraging UI Automation to access protected information in a way that bypasses most endpoint detection and response (EDR) solutions.
The use of UIA marks a turning point, as this Microsoft accessibility framework designed to help people with disabilities interact with application interfaces provides an attacker with deep visibility into the UI layer of running applications.
Coyote’s process involves monitoring the foreground window using Windows APIs like GetForegroundWindow(), scanning for titles associated with targeted banks and crypto sites.
If no direct match is found, the malware shifts to UIA routines: it instantiates the UIAutomation COM object with the active window as a root element and iterates through its child elements to identify browser tabs and address bars containing financial websites of interest.
Upon finding a match, Coyote attempts to extract user credentials for exfiltration to its command and control infrastructure.
Targets Brazilian Banks and Crypto Platforms
UI Automation’s COM-based architecture enables Coyote to programmatically scrape the UI content of processes running at the same privilege level.
This bypasses more complex reverse engineering requirements and allows the malware to adapt to different browsers and interface layouts.
In effect, Coyote can parse sensitive sub-elements such as input fields across a variety of applications, vastly increasing its odds of capturing login data even if the user’s browser or session title does not match known targets.
The analyzed variant classified its targets into categories ranging from major Brazilian banks like Banco do Brasil, CaixaBank, and Bradesco, to router management apps and multiple cryptocurrency wallets by mapping window or tab addresses against a hardcoded lookup table.
The subtleties of UIA allow for stealthier forms of attack. For example, Akamai’s research demonstrates how UIA can not only extract sensitive data but also simulate user interactions, enabling advanced social engineering.
Attackers could, for example, alter address bar contents and programmatically redirect users to phishing sites with minimal visual cues further complicating detection and response efforts.
Given the difficulty of identifying UIA-based abuse, Akamai recommends monitoring for suspicious usage of UIAutomationCore.dll in unknown processes and keeping track of unusual UIA-named pipe activity on endpoints.
According to the Report, The hunt for these indicators can be supported by osquery-driven analytics, which help uncover processes loading UIA modules or opening UIA-specific named pipes.
Solutions like Akamai Hunt have already begun to scan customer environments for such anomalies, alerting defenders to suspicious UIA activity before it can escalate.
This incident underscores the growing innovation among cybercriminal groups in subverting built-in operating system features to bypass security controls, and serves as a call to action for defenders to enhance monitoring and detection capabilities around legitimate-but-exploitable frameworks such as Windows UI Automation.
The rapid adoption of novel abuse techniques by Coyote further highlights the need for vigilance and continued research into emerging threat vectors across all platforms.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
