Mekotio

Mekotio is a sophisticated and persistent banking trojan that has primarily targeted Latin American countries since at least 2015. This malware, designed to exploit and damage computer systems, typically spreads through phishing emails that employ social engineering tactics. Once inside a system, Mekotio collects information and establishes a connection with a command-and-control (C2) server, which directs the malware's actions. It can capture screenshots, log keystrokes, and steal clipboard data, with its primary objective being to steal banking credentials. Notably, Mekotio has been particularly active in Brazil, Chile, Mexico, Spain, and Peru. Security researchers have recently warned about threat actors abusing Google Cloud Run to distribute massive volumes of banking trojans, including Mekotio, Astaroth/Guildma, and Ousaban. In these campaigns, JavaScript (JS) uses AutoHotKey (AHK) to run the Dynamic Link Library (DLL), which serves as the main Mekotio payload. This innovative misuse of Google Cloud Run allows the attackers to spread their harmful programs more widely and effectively. To ensure its ongoing presence on an infected system, Mekotio employs various persistence mechanisms, such as adding itself to startup programs or creating scheduled tasks. These techniques, coupled with its ability to stealthily infiltrate systems and steal sensitive information, make Mekotio a significant and evolving threat to financial systems worldwide, but especially in Latin America. As such, continuous vigilance and robust cybersecurity measures are crucial to counter this malicious software.