TCLBANKER Banking Trojan Uses Logitech Sideloading and Self-Spreads via WhatsApp

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

TCLBANKER

Observables

19 linked

Domain••••••.comURLhttps://••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

SHA-1 hash••••••••••••••••••••••••••••••••••••••••IPv4 address•••.••.•••.•••Domain•••••••••••.ruURLhttps://•••••.•••/••••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

+11

Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.

See Your Sector's Threats

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · May 9, 2026

TCLBANKER Malware Targets Users Through Self-Propagating WhatsApp and Outlook Worm ModulesOpen source ↗

The Hacker NewsNews · May 8, 2026

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook WormsOpen source ↗

Bleeping ComputerNews · May 7, 2026

New TCLBanker malware self-spreads over WhatsApp and OutlookOpen source ↗

Elastic Security LabsNews · Apr 11, 2026

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook - Elastic Security LabsOpen source ↗

On the same thread

Elastic Security Labs identified **TCLBANKER**, a Brazilian banking trojan linked to campaign `REF3076` and assessed as a major evolution of the MAVERICK/SORVEPOTEL family. Delivered in a trojanized Logitech Logi AI Prompt Builder MSI archive, the malware uses DLL sideloading and an evasive loader to deploy protected .NET banking and worm components. Its banking module geofences for Brazil, watches browser activity for 59 Brazilian banking and cryptocurrency sites, and opens a WebSocket command-and-control channel when victims visit a targeted service. Operators can remotely access devices, capture and stream screens, log keystrokes, alter clipboard contents, execute shell commands, and use full-screen credential overlays and vishing to steal financial-account access. TCLBANKER’s WhatsApp and Outlook modules propagate phishing messages through authenticated WhatsApp Web sessions and victims’ Outlook accounts, while Cloudflare Workers support command-and-control, payload delivery, updates, and campaign management. Its delivery and evasion methods—MSI installers, scripting, DLL sideloading, active-window monitoring, institution-specific overlays, and remote-access capabilities—reflect techniques long associated with Latin American banking-trojan operations. ESET previously reported that the region’s banking-malware families, although likely operated by separate groups, shared distribution chains, obfuscation approaches, and implementation details, suggesting an ecosystem in which tactics are routinely exchanged and refined.

May 7, 2026

Maverick Banking Trojan Spreads via WhatsApp and Steals Financial Credentials

A new banking Trojan named Maverick has been identified targeting users in Brazil through a sophisticated, fileless malware campaign. The infection chain begins with the distribution of malicious ZIP files containing LNK shortcuts, which are sent via WhatsApp messages. These LNK files are not blocked by WhatsApp, allowing the malware to propagate widely among Brazilian users. Once a device is infected, the Maverick Trojan leverages the open-source WPPConnect project to automate the sending of further malicious messages from the victim’s WhatsApp Web account, effectively turning compromised devices into worms that spread the malware to additional contacts. The Trojan is highly targeted, checking the infected system’s time zone, language, and regional settings to ensure it only installs on Brazilian machines. Upon successful infection, Maverick operates entirely in memory, minimizing disk activity and making detection more difficult. The malware is modular, using PowerShell and .NET components to execute its payloads. Its primary objective is to steal banking and UPI credentials by monitoring browser activity, taking screenshots, logging keystrokes, and overlaying phishing pages when users access banking websites. Maverick can also control the mouse, block the screen during sensitive operations, and terminate processes to evade detection. The campaign specifically targets 26 Brazilian banks, 6 cryptocurrency exchanges, and a major payment platform, indicating a broad financial focus. The command-and-control infrastructure is designed to verify that downloads originate from the malware itself, adding another layer of evasion. Researchers have noted significant code overlap between Maverick and the previously known Coyote Trojan, but Maverick is considered a distinct and new threat. The use of WhatsApp as a distribution vector is particularly concerning, as it exploits the trust between contacts and the widespread use of the messaging platform in Brazil. The fileless nature of the attack chain, combined with the use of legitimate open-source tools, complicates detection and remediation efforts. Security experts recommend heightened vigilance for suspicious WhatsApp messages containing attachments, especially those in Portuguese or referencing financial matters. Organizations and individuals are urged to update their security solutions and educate users about the risks of opening unsolicited files, even from known contacts. The emergence of Maverick underscores the evolving tactics of cybercriminals targeting the Brazilian financial sector and highlights the need for robust, multi-layered defenses.

Oct 15, 2025

WhatsApp Worm Spreads Eternidade Stealer Banking Trojan in Brazil

Researchers reported a Brazil-focused malware campaign that hijacks **WhatsApp Web** sessions to spread a malicious ZIP archive and deploy the **Eternidade Stealer** banking trojan. The infection chain uses an obfuscated **VBScript** downloader, an **MSI** dropper, an **AutoIt** loader, and a final **Delphi-based** payload, while a parallel Python-based worm installs **Selenium** and **ChromeDriver** to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for **Portuguese (Brazil)** language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms. Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and **process hollowing** into `svchost.exe`, while command-and-control relies on attacker infrastructure including a PHP server, `013net.com.br`, and **IMAP over SSL** with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a **Water-Saci/SorvePotel** variant and compared with older Brazilian banking trojans such as **Casbaneiro**, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.

Nov 24, 2025

TCLBANKER Banking Trojan Uses Logitech Sideloading and Self-Spreads via WhatsApp

How this story unfolded

Researchers reveal TCLBANKER spreads via WhatsApp and Outlook worms

Elastic identifies TCLBANKER banking trojan campaign REF3076

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

TCLBANKER Banking Trojan Uses Logitech Sideloading and Self-Spreads via WhatsApp

How this story unfolded

Researchers reveal TCLBANKER spreads via WhatsApp and Outlook worms

Elastic identifies TCLBANKER banking trojan campaign REF3076

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

TCLBANKER Banking Trojan Uses Logitech Sideloading and Self-Spreads via WhatsApp

How this story unfolded

Researchers reveal TCLBANKER spreads via WhatsApp and Outlook worms

Elastic identifies TCLBANKER banking trojan campaign REF3076

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

TCLBANKER Banking Trojan Spreads Through WhatsApp and Outlook

Maverick Banking Trojan Spreads via WhatsApp and Steals Financial Credentials

WhatsApp Worm Spreads Eternidade Stealer Banking Trojan in Brazil

TCLBANKER Banking Trojan Uses Logitech Sideloading and Self-Spreads via WhatsApp

How this story unfolded

Researchers reveal TCLBANKER spreads via WhatsApp and Outlook worms

Elastic identifies TCLBANKER banking trojan campaign REF3076

Related entities

Malware

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

TCLBANKER Banking Trojan Spreads Through WhatsApp and Outlook

Maverick Banking Trojan Spreads via WhatsApp and Steals Financial Credentials

WhatsApp Worm Spreads Eternidade Stealer Banking Trojan in Brazil