TCLBANKER Malware Leverages WhatsApp and Outlook Worm Features in Active Attacks

**Executive summary:** The report analyzes REF3076, a campaign distributing TCLBANKER — a sophisticated Brazilian-targeted banking trojan delivered via a trojanized Logitech MSI and DLL sideloading — which deploys .NET Reactor-protected banking and worm modules, uses environment-based payload decryption and anti-analysis techniques, performs geofencing and active browser URL monitoring to target Brazilian banks, and self-propagates by harvesting contacts and sending phishing via WhatsApp and Outlook; the report includes hashes, domains, developer artifacts, and evidence of active C2 infrastructure hosted under a Cloudflare Workers account.