{"id":1502,"date":"2026-06-01T23:17:37","date_gmt":"2026-06-01T23:17:37","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=1502"},"modified":"2026-06-02T23:27:36","modified_gmt":"2026-06-02T23:27:36","slug":"blue-margay","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2026\/06\/01\/blue-margay\/","title":{"rendered":"Blue Margay"},"content":{"rendered":"\n
\n
\n
\n

<\/a>Overview<\/h1>\n

The purpose of this post is to describe the TTPs of the threat group Blue Margay<\/em>, as named by SCILabs, which targets users and organizations primarily from Brazil with the aim of committing banking fraud, with the capability of stealing banking credentials and, in some variants, also detect or attack cryptocurrency and payment platforms. Through an advanced technical arsenal that integrates the Silver Oryx Blade<\/em>, Coyote<\/em>, and Maverick <\/em>banking trojans, the group has demonstrated critical capabilities for dynamic transaction monitoring and the interception of cryptocurrency platforms<\/p>\n

The attribution of different malware variants to this threat group is based on the record of multiple technical similarities among its artifacts, notably the recurring use of the WatsonTCP<\/a> library for communication with the command-and-control (C2) server, the use of Fody Costura<\/a> to embed resources within binaries developed with .NET, and identical encryption and obfuscation routines based on AES<\/a> and Base64<\/a> . In addition to using these development tools, these threats exhibit a linked infrastructure through the use of local X509 certificates<\/a> to secure their SSL tunnels<\/a> and maintain an identical victim profile, designed exclusively to target end-users in Brazil through environment validation and geofencing<\/a>.<\/p>\n

This adversary\u2019s primary initial access vector is through phishing campaigns to distribute malware, impersonating a tax authority such as Brazil\u2019s Minist\u00e9rio da Fazenda (Ministry of Finance). Additionally, phishing emails were observed that purport to originate from internal departments such as finance and HR, using pretexts such as a supposed salary bonus or sudden changes to vacation requests.<\/p>\n

Another access vector is via WhatsApp Web messages from previously compromised contacts, containing a ZIP file with a malicious LNK file used as a dropper.<\/p>\n

Based on its investigation, SCILabs observed that Blue Margay <\/em>has been targeting Brazil with its campaigns since at least February 2024 using the Coyote<\/em> banking trojan; however, based on the evidence provided in this report, \u00a0SCILabs determined with a high degree of confidence that the group is operating behind other threats of this type, such as Silver Oryx Blade <\/em>and Maverick<\/em>, which are developed with the assistance of artificial intelligence according to some open-sources<\/a>.<\/p>\n

<\/a>Region of Operation<\/h1>\n

As a result of open-source intelligence gathering and the analysis of various malicious artifacts, SCILabs determined with a high <\/strong>degree of confidence that the primary target country for this threat group\u2019s operations is Brazil, marked in red, while countries marked in yellow are potential targets for this threat actor.<\/p>\n

<\/a><\/p>\n

\"\"<\/p>\n

Figure 1. Region of operation determined by SCILabs<\/strong><\/p>\n

<\/a>Relevant Blue Margay <\/em>Activity<\/h1>\n

The following image shows a timeline of some Blue Margay <\/em>attacks based on events identified by SCILabs since August 2024, due to their media impact or magnitude.<\/p>\n

\"\"<\/p>\n

Figure 2. Blue Margay campaign timeline<\/strong><\/p>\n

The attacks observed in the Blue Margay<\/em> timeline are described below:<\/p>\n