TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms
A previously unknown Brazilian banking trojan known as TCLBANKER has been discovered by threat hunters. It can target 59 banking, fintech, and cryptocurrency systems.
Elastic Security Labs is monitoring the activities under the code REF3076. The malware family is thought to be a significant upgrade of the Maverick family, which is known to use a worm known as SORVEPOTEL to propagate to a victim's contacts over WhatsApp Web. Trend Micro attributes the Maverick campaign to a malware cluster known as Water Saci.
A loader with strong anti-analysis capabilities in the center of the attack chain launches two embedded modules: a fully functional banking trojan and a worm component that spreads via Microsoft Outlook and WhatsApp.
According to security experts Jia Yu Chan, Daniel Stepanic...