TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

Recent investigations have uncovered a new Brazilian banking trojan, identified as TCLBANKER, which poses significant threats to a wide range of financial platforms. This malware is capable of targeting 59 different banking, fintech, and cryptocurrency services, highlighting its extensive reach and potential for damage.

What Happened

The activity surrounding TCLBANKER has been tracked by Elastic Security Labs under the designation REF3076. This malware appears to be an evolved version of the previously known Maverick banking trojan. TCLBANKER employs a sophisticated infection chain that utilizes a worm component, SORVEPOTEL, to propagate through WhatsApp Web, leveraging the contacts of infected users.

At the heart of the attack is a loader that integrates advanced anti-analysis features. This loader deploys two key modules: a full-fledged banking trojan and a worm that propagates via WhatsApp and Microsoft Outlook. The malware is delivered through a malicious MSI installer packaged within a ZIP file, which exploits a legitimate signed Logitech application known as Logi AI Prompt Builder.

Why It Matters

The emergence of TCLBANKER underscores the evolving tactics of cybercriminals, particularly in the context of banking malware. Its ability to bypass traditional security measures through sophisticated anti-analysis techniques poses a significant challenge for security teams. The malware's reliance on social engineering tactics to spread through popular communication platforms like WhatsApp further amplifies its threat level.

📬 Stay ahead of the threat

Get the latest SOC guides, threat intel, and detection engineering — straight to your inbox.

Affected Users or Organizations

TCLBANKER primarily targets users within Brazil, as evidenced by its checks for the Brazilian Portuguese language and its focus on local banking systems. Organizations in the financial sector, including banks and fintech companies, are particularly at risk, as the trojan is designed to extract sensitive information and facilitate unauthorized transactions.

Recommended Actions

  • Implement Endpoint Protection: Ensure that endpoint security solutions are in place and regularly updated to detect and mitigate threats like TCLBANKER.
  • User Education: Conduct training sessions for employees to recognize phishing attempts and suspicious communications, particularly through messaging platforms.
  • Monitor Network Traffic: Utilize network monitoring tools to identify unusual outbound connections that may indicate a compromised system.
  • Regular Software Updates: Keep all software, especially security tools, up to date to protect against known vulnerabilities that could be exploited by malware.
  • Incident Response Plan: Develop and maintain an incident response plan to quickly address any potential infections and minimize damage.

As the threat landscape continues to evolve, staying informed and proactive is essential for organizations to safeguard their financial assets and customer data against emerging threats like TCLBANKER.