New TCLBanker Malware Self-Spreads Over WhatsApp and Outlook

Elastic Security Labs documented TCLBanker, a sophisticated Brazilian-focused banking trojan delivered through a trojanized MSI and a sideloaded malicious DLL; it deploys a banking trojan with WPF overlays for credential theft and worm modules that clone WhatsApp Web sessions and automate Outlook to send phishing messages from victims' own accounts, enabling rapid self-propagation to contacts and posing significant risk to Brazilian banking, fintech, and crypto users as well as organizations whose employees use WhatsApp Web or Outlook on Windows.