Signed Logitech Installer Used In TCLBANKER Banking Trojan Attacks

TCLBANKER is a newly observed, sophisticated Brazilian banking trojan campaign that targets 59 banking, fintech, and cryptocurrency platforms by abusing a legitimately signed Logitech MSI via DLL sideloading to execute malicious code. The malware performs strong sandbox/VM detection and environmental hashing, patches ETW to evade telemetry, establishes persistence via Task Scheduler, monitors browser URLs and uses UI Automation to present full-screen overlays for credential theft, and includes self-propagating worm modules that abuse WhatsApp and Outlook to spread and exfiltrate contacts and session data.