TCLBANKER is a banking trojan targeting Brazilian financial institutions, representing an evolution of the MAVERICK/SORVEPOTEL malware family. It spreads via a trojanized Logitech installer that side-loads .NET Reactor-protected modules. The trojan monitors 59 Brazilian banks using UI Automation and uses a WPF-based overlay for operator-driven social engineering to steal credentials and display fake system screens. A secondary worm module enables self-propagation by hijacking WhatsApp sessions and automating Outlook to send phishing messages from victims' accounts. The malware employs robust anti-analysis techniques including environment-gated payload decryption, watchdog mechanisms, and ETW patching. Its command and control infrastructure is hosted on Cloudflare Workers. The campaign was detected early in its operational phase, indicating potential for further development.

The malware enables credential theft from users of 59 Brazilian financial institutions, potentially leading to financial fraud and account compromise. Its worm-like propagation through WhatsApp and Outlook allows rapid spread by abusing victims' own communication channels, increasing infection rates and phishing reach. The use of full-screen overlays and social engineering techniques can deceive users into divulging sensitive information. Anti-analysis features complicate detection and analysis, potentially prolonging infection and impact. However, there is no indication of known exploits in the wild beyond the campaign described, and the campaign is in early stages.

No official patch or remediation is currently available for TCLBANKER as it is malware rather than a software vulnerability. Mitigation should focus on user awareness to avoid trojanized installers and suspicious links, especially on WhatsApp and Outlook. Organizations should monitor for indicators of compromise such as the provided hashes and domains. Endpoint detection and response solutions should be updated to detect DLL side-loading and .NET Reactor-protected modules. Since the infrastructure is hosted on Cloudflare Workers, blocking related domains and network indicators may help limit communication. Check vendor advisories and threat intelligence feeds for updates on detection and mitigation strategies.