The malware is looking for open banking and crypto-related sites to collect keystrokes and steal passwords. The researchers have found banking platforms such as caixa.gov.br, safra.com.br, itau.com.br ...