TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

TCLBANKER is a Brazilian banking trojan targeting 59 financial platforms via sophisticated anti-analysis techniques.

• •Uses DLL side-loading through signed Logitech software to deploy malicious payload
• •Employs anti-debugging, anti-virtualization, and language checks for environment-gated payload decryption
• •Spreads via WhatsApp Web worm and Outlook bot to hijack sessions and send phishing emails
• •Executes remote commands via WebSocket including keylogging and credential harvesting
• •Uses WPF full-screen overlays for social engineering with fake credential prompts

This summary was automatically generated by AI based on the original article and may not be fully accurate.