TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

TCLBANKER is a newly documented Brazilian banking trojan (tracked as REF3076) that combines a loader with strong anti-analysis checks, a full-featured banking trojan (credential-stealing overlays, keylogging, remote control) and a worming module that propagates via WhatsApp Web and Microsoft Outlook. The malware abuses a signed Logitech installer for DLL side-loading, environment-gated payload decryption that favors Brazilian Portuguese systems, and uses WebSocket C2 for real-time social engineering; the campaign is in early operational stages but is capable of mass distribution and sophisticated fraud against banking, fintech, and crypto platforms.