New TCLBanker malware self-spreads over WhatsApp and Outlook

Elastic Security Labs discovered TCLBanker, a new banking trojan that sideloads into a legitimate Logitech MSI, employs strong anti‑analysis techniques and a persistent watchdog, and provides operators with remote access, keylogging, screen streaming and overlay-based credential theft. Notably, it includes worm modules that hijack WhatsApp Web and automate Outlook to harvest contacts and spread via phishing to Brazilian banking, fintech and cryptocurrency targets; researchers warn the threat could expand beyond LATAM.