TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Elastic Security LabsMay 7, 2026Threat Intel

REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules.

Summary from Elastic Security Labs.

Read the full article at Elastic Security Labs

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet