Ankura CTIX FLASH Update - July 25, 2025

Malware Activity

Unveiling New Frontiers in Cybercrime: From Innovative Malware Techniques to Regional Threats

The cybersecurity landscape has seen groundbreaking developments with the discovery of Coyote. The first known malware to exploit the Windows UI Automation framework to steal sensitive banking and cryptocurrency credentials, primarily targeting Brazilian users. By manipulating legitimate assistive technology features, Coyote enhances its ability to bypass defenses, capturing login details through sophisticated parsing of UI elements. Concurrently, Mexican organizations remain under persistent threat from Greedy Sponge. A financially motivated group deploying modified RATs like AllaKore and SystemBC via phishing and drive-by downloads. Recent updates incorporating refined geofencing to evade detection. The threat actors are also leveraging advanced crypters like Ghost Crypt and evolving RAT variants such as Neptune RAT. Employing encrypted payloads and