Mekotio

Mekotio is a type of malware, specifically a banking trojan, that was first detected in March 2018. Initially focusing on Brazilian users and banks, Mekotio has since evolved to target other Spanish-speaking countries such as Chile, Mexico, Columbia, and Argentina, as well as parts of Southern Europe, including Spain. It is predominantly delivered through phishing emails with malicious attachments, making it a versatile and persistent threat in the region. Mekotio shares common geographical targets with BBTok, another banking trojan first detected in 2020, which primarily targets the Latin American financial sector. In recent campaigns, Mekotio, along with Astaroth/Guildma and Ousaban, has been observed misusing Google Cloud Run service for distribution. Security researchers have issued warnings about these large-scale attacks, where threat actors are exploiting the cloud service to spread massive volumes of these banking trojans. The JavaScript used in these campaigns employs AutoHotKey (AHK) to run the DLL, which serves as the main payload for Mekotio. Notably, the variant of Mekotio investigated in this study does not include a country comparison feature, distinguishing it from previous versions. This latest variant expands its targets geographically, further increasing its threat level. The infection chain involves the creation of the AutoHotKey.exe, a malicious AHK script, and the Mekotio DLL from a downloaded ZIP file. Once inside a system, Mekotio gathers victim information, posing significant risks to personal data security.