VENON banking trojan targeting Latin America was rewritten in Rust, likely with AI help

Researchers have described a new banking trojan, VENON, that targets Windows users and copies the behavior of well-known Latin American malware. The key difference is that it is written in Rust, and analysts say its structure points to heavy use of generative AI during development.

Why this is unusual

This approach is atypical for Latin American banking trojans. The region has long been dominated by families such as Grandoreiro, Mekotio and Coyote, usually written in Delphi. VENON repeats their core logic: it monitors active windows, spoofs the user interface of banking pages and hijacks Windows shortcuts. In effect, the attackers did not invent a new attack mechanism; they took a familiar model and moved it to a different technology stack.

The choice of Rust is what makes the story notable. The language demands more technical skill than a typical malware builder kit or a quick assembly with familiar tools. Researchers believe the author understood how local banking attacks work, but relied on generative AI to recreate and extend that feature set in Rust. This is no longer simple copying of someone else's code, but a new way to quickly assemble mature malicious tools from familiar patterns.

How VENON works

VENON's infection chain has multiple stages. According to the researchers, the malware is launched through DLL side-loading and may be delivered to the victim via a ZIP archive and a PowerShell script. The ClickFix technique is also mentioned, in which social engineering pushes the user to launch the malicious chain themselves. After starting, the DLL does not rush to reveal itself: it first checks the environment and tries to confirm that it has not landed in a sandbox or under the watch of security tools.

• Checks whether the sample is running in a virtual environment
• Uses indirect system calls to hide its activity
• Attempts to bypass ETW and AMSI before launching the payload
• Loads its configuration from Google Cloud Storage and creates a scheduled task
• Opens a WebSocket connection to the command server

The malware then moves on to its main job. The DLL drops two Visual Basic scripts that hijack Windows shortcuts; the research says they target the Itaú banking app. At the same time, VENON tracks browser window titles and active domains. If the user opens one of the services of interest, the trojan overlays a fake layer on the screen and intercepts credentials. In total, the target list includes 33 financial organizations and crypto platforms.

Another detail is a built-in rollback mechanism. After replacing the shortcuts, the malware can restore them to their original state, probably to cover the traces of the attack. This does not make VENON a technological breakthrough, but it shows the author thought not only about stealing data but also about concealment after the operation. Such a set of techniques makes the campaign more resilient: a victim may not immediately realize that their bank or crypto service login went through a fake interface.

Why researchers see AI here

The generative AI theory did not come from a single glaring marker, but from the overall structure of the project. Analysts at ZenoX believe the developer clearly modeled the work on the region's known banking trojans, but used AI to port that logic to Rust and to expand its functionality. In other words, the author did not start from zero expertise, but part of the engineering work could have been accelerated with an LLM and so-called vibe coding.

Researchers have not yet been able to link VENON to a specific cybercrime group. In an early sample dated January 2026, they found an artifact with the username byst4, but that is not enough for confident attribution. For the security industry, another conclusion matters more: generative models now help not only write harmless utilities and prototypes, but also package malicious logic in a more modern stack that is less familiar to analysts.

What this means

The VENON case shows that AI lowers the barrier to entry even for complex malware projects, but does not remove the need to understand attack tactics. For defenders, it is a signal to strengthen behavioral analysis, look more closely at Rust components, and assume that the next wave of banking trojans may be assembled faster than classic signatures are updated.