A new banking Trojan, new of its kind in the market, was discovered recently by cyber security researchers in Brazil. The malware targeted South American banks and attempted to steal the personal details of users for illegal financial abuse. The Trojan is critical since it exploits an authentic VMware binary to deceive security tools into accepting errant activity, it appears legitimate but it uses a wide range of sophisticated techniques to stay dormant.

The malware is spreading through a Boleto invoice, a famous payment method in Brazil, and it contains a malicious file and a shortened link that redirects to a RAR library which contains a JAR file that loads and executes the malicious code to install the banking trojan when clicked.