Cybersecurity researchers have disclosed particulars of a brand new banking malware focusing on Brazilian customers that is written in Rust, marking a major departure from different identified Delphi-based malware households related to the Latin American cybercrime ecosystem.
The malware, which is designed to contaminate Home windows techniques and was first found final month, has been codenamed VENON by Brazilian cybersecurity firm ZenoX.
What makes VENON notable is that it shares behaviors which might be in line with established banking trojans focusing on the area, resembling Grandoreiro, Mekotio, and Coyote, particularly on the subject of options like banking overlay logic, lively window monitoring, and a shortcut (LNK) hijacking mechanism.
The malware has not been attributed to any beforehand documented group or marketing campaign. Nonetheless, an earlier model of the artifact, courting again to January 2026, has been discovered to show full paths from the malware writer’s improvement surroundings. The paths repeatedly reference a Home windows machine username “byst4” (e.g., “C:Usersbyst4…”).
“The Rust code construction presents patterns suggesting a developer accustomed to the capabilities of present Latin American banking trojans, however who used generative AI to rewrite and develop these functionalities in Rust, a language that requires important technical expertise to make use of on the noticed stage of sophistication,” ZenoX mentioned.
VENON is distributed via a classy an infection chain that makes use of DLL side-loading to launch a malicious DLL. It is suspected that the marketing campaign leverages social engineering ploys like ClickFix to trick customers into downloading a ZIP archive containing the payloads via a PowerShell script.
As soon as the DLL is executed, it performs 9 evasion methods, together with anti-sandbox checks, oblique syscalls, ETW bypass, AMSI bypass, earlier than truly initiating any malicious actions. It additionally reaches out to a Google Cloud Storage URL to retrieve a configuration, set up a scheduled activity, and set up a WebSocket connection to the command-and-control (C2) server.
Additionally extracted from the DLL are two Visible Fundamental Script blocks that implement a shortcut hijacking mechanism solely focusing on the Itaú banking software. The parts work by changing the reputable system shortcuts with tampered variations that redirect the sufferer to an internet web page underneath the risk actor’s management.
The assault additionally helps an uninstall step to undo the modifications, suggesting that the operation might be remotely managed by the operator to revive the shortcuts to what they initially had been to cowl up the tracks.
In all, the banking malware is supplied to focus on 33 monetary establishments and digital asset platforms by monitoring the window title and lively browser area, springing into motion solely when any of the focused purposes or web sites are opened to facilitate credential theft by serving faux overlays.
The disclosure comes amid campaigns the place risk actors are exploiting the ubiquity of WhatsApp in Brazil to distribute a worm named SORVEPOTEL through the messaging platform’s desktop net model. The assault hinges on abusing beforehand authenticated chats to ship malicious lures on to victims, finally ensuing within the deployment of banking malware resembling Maverick, Casbaneiro, or Astaroth.
“A single WhatsApp message delivered by way of a hijacked SORVEPOTEL session was adequate to attract a sufferer right into a multi-stage chain that finally resulted in an Astaroth implant working absolutely in reminiscence,” Blackpoint Cyber mentioned.
“The mixture of native automation tooling, unsupervised browser drivers, and user-writable runtimes created an unusually permissive surroundings, permitting each the worm and the ultimate payload to ascertain themselves with minimal friction.”
