TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Elastic Security Labs details TCLBANKER (REF3076), a Brazilian-focused banking trojan and worm bundle that uses robust anti-analysis and environment-gated decryption to deploy a .NET-protected banker and propagation modules (WhatsApp and Outlook). The malware monitors browser URLs, establishes WebSocket C2, supports operator-driven full-screen overlays for credential theft and vishing, and hosts C2/file infrastructure on Cloudflare Workers; the report includes technical breakdowns, IOCs (hashes and domains), and evidence the campaign is in early operational stages.