Coyote malware abuses Microsoft's UI Automation to hunt banking creds

A new variant of the Coyote banking trojan abuses Microsoft's UI Automation (UIA), making it the first reported malware to use UIA for credential theft. According to Akamai, which documented the UIA abuse in a Tuesday report, this Coyote variant is being aimed at Brazilians, and has already used the Microsoft accessibility …

[druck]

Not signed?

I used to work on assistive technology before pretty much any security was added to Windows and you could hook in to all the UI calls an application made to build a comprehensive screen model. I left that field almost 20 years ago, but thought the whole point of inter-application security busting assistive APIs is that they would be restricted to signed code which had been thoroughly vetted. It doesn't really come as any surprise that Microsoft have failed on this too.