Loading story…
Elastic Security Labs identified TCLBANKER, a Brazilian banking trojan linked to campaign REF3076 and assessed as a major evolution of the MAVERICK/SORVEPOTEL family. Delivered in a trojanized Logitech Logi AI Prompt Builder MSI archive, the malware uses DLL sideloading and an evasive loader to deploy protected .NET banking and worm components. Its banking module geofences for Brazil, watches browser activity for 59 Brazilian banking and cryptocurrency sites, and opens a WebSocket command-and-control channel when victims visit a targeted service. Operators can remotely access devices, capture and stream screens, log keystrokes, alter clipboard contents, execute shell commands, and use full-screen credential overlays and vishing to steal financial-account access.
TCLBANKER’s WhatsApp and Outlook modules propagate phishing messages through authenticated WhatsApp Web sessions and victims’ Outlook accounts, while Cloudflare Workers support command-and-control, payload delivery, updates, and campaign management. Its delivery and evasion methods—MSI installers, scripting, DLL sideloading, active-window monitoring, institution-specific overlays, and remote-access capabilities—reflect techniques long associated with Latin American banking-trojan operations. ESET previously reported that the region’s banking-malware families, although likely operated by separate groups, shared distribution chains, obfuscation approaches, and implementation details, suggesting an ecosystem in which tactics are routinely exchanged and refined.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
ESET Research published a white paper identifying at least 11 concurrently active Latin American banking-trojan families and assessing that their operators likely exchanged implementation details, distribution chains, obfuscation methods, and execution techniques.
ESET observed coordinated-looking expansion of several Latin American banking-trojan families into Spain and Portugal beginning in 2019, alongside probing of other European language variants.
Almost all analyzed Latin American banking-trojan families switched from LNK files to MSI installers during 2019, often using Advanced Installer packages containing DLLs or scripts.
Use of VMProtect among the analyzed Latin American banking-trojan families declined in 2018, with Themida increasingly replacing it.
ESET observed that LNK files were a favored initial malicious-file format among Latin American banking trojans in 2017.
Researchers reported that TCLBANKER targets Brazilian financial and cryptocurrency sites, supports remote access and credential-stealing overlays, and can conceal fraudulent windows from screen capture. Separate WhatsApp Web and Outlook modules abuse authenticated victim accounts to distribute phishing messages and the malware payload.
Elastic Security Labs identified TCLBANKER as a Brazilian banking trojan tracked as REF3076 and assessed it as a significant evolution of the MAVERICK/SORVEPOTEL family. The campaign used a trojanized Logitech Logi AI Prompt Builder MSI archive, DLL sideloading, and Cloudflare Workers infrastructure for payload delivery, C2, updates, and campaign management.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs disclosed **TCLBANKER**, a Brazilian banking trojan assessed as a major evolution of the **MAVERICK/SORVEPOTEL** family, delivered through a trojanized MSI installer for Logitech's signed **Logi AI Prompt Builder** and executed via DLL sideloading. The malware targets **59** Brazilian banking, fintech, and cryptocurrency services, using anti-analysis checks, environment-gated payload decryption, ETW patching, watchdog functions, and .NET Reactor-protected modules to evade detection and maintain execution. Once active, it monitors browser activity through UI Automation and opens a WebSocket command-and-control channel when victims visit monitored financial sites. The malware's fraud tooling includes a **WPF full-screen overlay** framework that can present fake login prompts, counterfeit Windows Update screens, vishing wait pages, and screen-capture-resistant overlays to steal credentials and support operator-driven account takeover. A separate worm component propagates through **WhatsApp Web** by hijacking authenticated browser sessions and through **Microsoft Outlook** by using COM automation to send phishing emails from the victim's own account. Researchers said the campaign relies heavily on **Cloudflare Workers** for payload hosting and C2, and appears to be in an early operational stage based on exposed developer artifacts and unfinished phishing infrastructure.
Jun 29, 2026
Cybersecurity researchers have identified a new campaign targeting Brazilian users in which the Eternidade Stealer, a Delphi-based banking trojan, is distributed through a WhatsApp worm. The attack leverages social engineering and WhatsApp hijacking, with the threat actor deploying a Python script—marking a shift from previous PowerShell-based methods—to hijack WhatsApp Web sessions and spread malicious attachments. The campaign uses an obfuscated Visual Basic Script as the initial infection vector, which then drops a batch script responsible for delivering two payloads, including the Python-based worm. The malware utilizes the Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the attacker to update C2 infrastructure as needed. This activity is part of a broader trend in Brazil, where WhatsApp's ubiquity makes it a favored vector for distributing banking trojans and information stealers. The use of Delphi for malware development remains prevalent in Latin America due to its technical efficiency and regional familiarity. Researchers note that this campaign represents an evolution in tactics, building on previous attacks such as Water Saci, and highlights the increasing sophistication of social engineering and malware propagation techniques in the region's cybercrime ecosystem.
Jun 29, 2026
Researchers reported a Brazil-focused malware campaign that hijacks **WhatsApp Web** sessions to spread a malicious ZIP archive and deploy the **Eternidade Stealer** banking trojan. The infection chain uses an obfuscated **VBScript** downloader, an **MSI** dropper, an **AutoIt** loader, and a final **Delphi-based** payload, while a parallel Python-based worm installs **Selenium** and **ChromeDriver** to steal contacts and automatically send phishing messages to the victim’s WhatsApp contacts. The malware is heavily localized, checking for **Portuguese (Brazil)** language settings and focusing on Brazilian banks, fintech services, and cryptocurrency platforms. Once installed, the malware profiles the host, enumerates security products, monitors browser history and banking activity, and uses overlays and credential theft when targeted financial services are detected. Analysts said later stages are decrypted and loaded in memory, including reflective loading and **process hollowing** into `svchost.exe`, while command-and-control relies on attacker infrastructure including a PHP server, `013net.com.br`, and **IMAP over SSL** with hardcoded email credentials to retrieve updated infrastructure, with a fallback domain if that fails. The campaign, also tracked as a **Water-Saci/SorvePotel** variant and compared with older Brazilian banking trojans such as **Casbaneiro**, shows an evolving effort to combine messaging-platform worming with banking fraud and credential theft.
Aug 14, 2026