Self-Spreading TCLBANKER Trojan Hijacks WhatsApp to Drain Accounts

Elastic Security Labs reports a highly sophisticated Brazilian banking trojan, TCLBANKER (campaign REF3076), actively targeting 59 financial, fintech, and cryptocurrency domains; the malware uses WebSocket C2 to deploy full-screen WPF overlays (invisible to screen capture), performs credential harvesting, WhatsApp session hijacking, Outlook email automation, and includes self-propagating worm modules and strong sandbox-evasion techniques, indicating an active and escalating financial crime campaign.