TCLBANKER Banking Trojan Targets 59 Financial Platforms via WhatsApp, Outlook Worms

The Hacker News reports on a newly identified Brazilian banking trojan, TCLBANKER, which is actively targeting 59 distinct banking, fintech, and cryptocurrency platforms. Elastic Security Labs is tracking this activity under the moniker REF3076. This isn’t some minor variant; The Hacker News indicates TCLBANKER is a significant evolution of the Maverick malware family.

What makes TCLBANKER particularly nasty is its propagation method. According to The Hacker News, it leverages a worm, previously known as SORVEPOTEL, to spread aggressively. This worm utilizes both WhatsApp and Outlook, turning user communication channels into infection vectors. This means the threat isn’t just about direct compromises but also about lateral movement through trusted social and business platforms.

This isn’t just a Brazilian problem. While the origin is noted, banking trojans like this quickly go global, especially when they hit cryptocurrency platforms. Defenders need to recognize that the attacker’s calculus here is pure financial gain, and they’re willing to weaponize everyday communication tools to get it. This puts the onus on user education and robust endpoint protection.