Listen to this Post
Cybersecurity experts have uncovered a sophisticated new banking malware targeting Brazilian users, introducing a worrying evolution in the Latin American cybercrime landscape. Unlike most regional malware, traditionally written in Delphi, this new threat is developed in Rust—a programming language known for its complexity and security focus. Named VENON by Brazilian cybersecurity firm ZenoX, the malware signals a shift toward more technically advanced attacks that could reshape how financial cyber threats are executed in the region.
Emergence of VENON: A Summary
VENON was first detected last month targeting Windows systems, with behaviors closely mirroring established Latin American banking trojans such as Grandoreiro, Mekotio, and Coyote. Key features include banking overlay logic, active window monitoring, and a shortcut (LNK) hijacking mechanism designed to intercept sensitive banking operations. While it has not yet been linked to any known threat actor, researchers discovered a version from January 2026 revealing full development paths on a Windows machine, pointing to a user named “byst4.”
The
Once active, VENON performs nine advanced evasion techniques—including anti-sandbox checks, ETW and AMSI bypasses, and indirect syscalls—before executing any malicious actions. It communicates with a Google Cloud Storage URL to retrieve configurations, installs scheduled tasks, and maintains a WebSocket connection to its command-and-control (C2) server. Additionally, VENON deploys Visual Basic Script blocks to hijack shortcuts exclusively for the Itaú banking application, redirecting users to attacker-controlled web pages to capture credentials. Notably, the malware can also uninstall its modifications, allowing operators to cover their tracks.
In total, VENON can monitor 33 financial institutions and digital asset platforms, activating overlays and phishing pages only when targeted apps or websites are opened. Its release coincides with another surge in Brazilian cyberattacks using the SORVEPOTEL WhatsApp worm, which exploits authenticated chats to deliver malware such as Maverick, Casbaneiro, or Astaroth, often resulting in fully in-memory implants. The combination of local automation tools, unsupervised browser drivers, and user-writable runtimes creates an environment where malware can operate with minimal friction.
What Undercode Says:
Advanced Rust Development Signals New Cybercrime Trends
VENON’s use of Rust is significant. Traditionally, Latin American banking malware has relied on Delphi due to its rapid development capabilities and compatibility with Windows environments. Rust, however, is more complex and secure, suggesting that threat actors are moving toward higher technical sophistication, likely aiming to evade conventional antivirus and malware detection systems.
Integration of AI in Malware Development
The discovery that VENON may incorporate generative AI for coding points to a new trend: attackers leveraging AI to enhance malware functionality. This allows for rapid iteration of malicious capabilities, including sophisticated banking overlays and automated evasion techniques, drastically increasing the efficiency and potential impact of attacks.
Evasion and Persistence Techniques
VENON’s nine-layer evasion strategy—including anti-sandbox checks, ETW bypass, and AMSI bypass—demonstrates a deep understanding of Windows security mechanisms. This makes it difficult for traditional endpoint protection tools to detect and mitigate the threat. Additionally, the ability to uninstall and restore original system shortcuts suggests a level of operational control usually reserved for nation-state malware campaigns.
Targeted Banking Approach
With 33 targeted financial institutions and digital asset platforms, VENON represents a highly focused attack methodology. By monitoring active windows and browser domains, the malware ensures it only activates in environments rich in sensitive financial data, optimizing credential theft while minimizing unnecessary exposure.
Social Engineering Amplified by Messaging Platforms
The coinciding SORVEPOTEL WhatsApp worm highlights how social engineering remains critical in malware distribution. Leveraging widely used platforms allows attackers to bypass traditional email and network security measures, delivering payloads directly to end users in an environment they trust.
Operational Implications for Brazilian Users
VENON emphasizes the ongoing vulnerability of Brazil’s financial ecosystem. Users relying on standard antivirus protections may face increasing risks, especially as attackers adopt AI-enhanced development, Rust-based sophistication, and multi-layered evasion strategies. Organizations need proactive monitoring, behavioral analysis, and threat intelligence to stay ahead.
Broader Implications for Global Cybersecurity
While VENON is currently Brazil-focused, its Rust-based framework and AI-assisted development could serve as a blueprint for future attacks worldwide. Cybersecurity firms and financial institutions outside Latin America should monitor these trends closely, preparing for similar campaigns that exploit advanced programming techniques and social engineering vectors.
Potential for Rapid Spread
Given VENON’s reliance on widely used tools such as PowerShell and Google Cloud Storage, it could be rapidly replicated or adapted for attacks in other regions. Its modularity and uninstall capabilities suggest that operators are designing it for long-term campaigns, capable of evolving to bypass updated security measures.
Challenges in Detection and Response
Traditional signature-based antivirus tools may struggle to detect VENON due to its novel Rust codebase and multiple evasion layers. Security teams will need to adopt heuristic analysis, anomaly detection, and network monitoring to identify suspicious activity, especially connections to C2 servers and unusual browser behavior.
Socioeconomic Impact on Brazil
With 33 financial institutions at risk and social engineering campaigns leveraging popular apps like WhatsApp, the economic impact could be significant. Credential theft may lead to direct financial losses, while undermining public trust in online banking, potentially slowing digital adoption in critical sectors.
Law Enforcement and Cybercrime Attribution
VENON’s lack of attribution complicates law enforcement efforts. The exposed development paths (“byst4”) offer leads but may also be intentional misdirection. Attribution will require cross-sector collaboration, forensic analysis, and potentially AI-assisted profiling of malware evolution patterns.
Long-Term Cybersecurity Recommendations
Brazilian institutions should invest in endpoint detection and response (EDR), employee cybersecurity awareness, and proactive monitoring of messaging platforms. Security frameworks must evolve to address AI-assisted malware and Rust-based threats to prevent a new wave of financial cybercrime.
🔍 Fact Checker Results
VENON has been confirmed as Rust-based and targets Windows banking systems. ✅
Malware distribution via DLL side-loading and PowerShell scripts is consistent with ZenoX research. ✅
Shortcut hijacking specifically targeting Itaú banking application has been verified. ✅
📊 Prediction
VENON may inspire a new generation of AI-assisted, Rust-based banking malware across Latin America and potentially globally. Financial institutions may see an uptick in sophisticated phishing campaigns and malware delivery via trusted messaging apps. Organizations implementing robust behavioral detection and AI-driven cybersecurity solutions will be better positioned to mitigate these threats. Cybercrime ecosystems are likely to evolve rapidly, leveraging multi-layered evasion and social engineering for more targeted, high-value attacks.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
