Hackers Abuse Signed Logitech Installer to Deploy TCLBANKER Banking Trojan

**TCLBANKER (REF3076)** is a newly observed Brazilian-targeted banking trojan distributed via a trojanized, digitally signed Logitech MSI that uses DLL sideloading to load a malicious Flutter plugin; it monitors browsers for 59 financial domains, establishes live C2 connections to present fraudulent overlays and block remediation, and includes worm modules that abuse WhatsApp Web and Outlook to propagate, with command/file infrastructure hosted via Cloudflare Workers and multiple provided IoCs (SHA-256 hashes and domains).