Rust Based Venon Malware Targets 33 Brazilian Banks

Brazilian cybersecurity firm Zenox reported a new Rust-based banking malware named Venon that targets users of 33 financial institutions and digital asset platforms in Brazil, including Itaú Bank. Zenox said the malware is notable for being written in Rust and for using modern evasion techniques uncommon in the region’s typical Delphi-based trojans.

Zenox researchers found Venon uses DLL side-loading to load a malicious payload, often delivered through a PowerShell script packaged as what appears to be a ZIP archive. Zenox said the campaign leverages social engineering lures and shortcut hijacking to trick victims into running the code.

According to Zenox, Venon includes multiple anti-analysis features: anti-sandbox checks, indirect syscalls, and bypasses for ETW and AMSI. After execution, Zenox observed that the malware retrieves configuration data from Google Cloud Storage, creates a scheduled task to maintain persistence, and opens a WebSocket channel to a command-and-control server for remote instructions.

Zenox detailed Venon’s credential-theft technique: the malware monitors active window titles and browser domains and triggers fake overlay pages that mimic legitimate banking login screens. Zenox said those overlays are ready for 33 targeted institutions and platforms, and that Itaú is specifically targeted via a shortcut hijacking routine. The malware also uses Visual Basic Script blocks to replace legitimate shortcuts with attacker-controlled links, while retaining an uninstall mechanism that can revert changes when the operator chooses.

On development and attribution, Zenox noted the Rust code structure resembles established Latin American banking trojans, but it appears to be a rewrite. Zenox researchers suggested parts of the implementation may have been assisted by generative AI, a sign that some threat actors are combining traditional trojan frameworks with modern tooling. Zenox also reported that no established criminal group has yet been definitively tied to Venon.

This case highlights a broader shift security teams need to watch. Apple issued security updates for iOS that addressed a WebKit exploit identified as CVE-2023-43010, and Meta said it disabled 150,000 accounts linked to organized scam operations in Southeast Asia. These moves underscore how platform vendors and social platforms are being forced to respond as attackers innovate.

Zenox recommended that organizations and users in Brazil strengthen endpoint protections, enable multi-factor authentication on financial accounts, and be wary of unexpected downloads or replaced shortcuts. Zenox also urged defenders to monitor unusual scheduled tasks, WebSocket traffic to unknown hosts, and downloads from cloud storage buckets used by attackers.

#bankingmalware #cybersecurity #malware #Brazil #Rust