Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays

VENON is a new Rust-based banking malware targeting Brazilian users that attacks 33 financial institutions via credential-stealing overlays.

• •Written in Rust unlike typical Delphi-based Latin American banking trojans, with code suggesting generative AI was used during development
• •Distributed via DLL side-loading combined with suspected ClickFix social engineering, delivering payloads through a PowerShell-executed ZIP archive
• •Executes nine evasion techniques before any malicious action, including anti-sandbox checks, indirect syscalls, ETW bypass, and AMSI bypass
• •Monitors window titles and active browser domains to serve fake overlays only when targeted banking apps or sites are opened
• •Implements LNK shortcut hijacking targeting the Itaú banking app, redirecting victims to attacker-controlled pages with a remote uninstall capability to cover tracks