Brazilian Banking Trojan TCLBANKER Targets 59 Platforms, Spreads via WhatsApp and Outlook

A newly identified banking trojan, dubbed TCLBANKER, has been uncovered by threat hunters and is already showing signs of self‑propagation through popular messaging and email services such as WhatsApp and Outlook. The malware, tracked by Elastic Security Labs under the code name REF3076, is believed to be a major evolution of the Maverick family, which previously relied on the SORVEPOTEL worm to spread through network shares and removable media. Unlike its predecessor, TCLBANKER adds sophisticated banking‑stealing modules that can harvest credentials and financial data from a wide range of banking, fintech, and cryptocurrency platforms.

The trojan’s reach is alarming: it can target 59 different financial services, including major banks, payment processors, and crypto exchanges. Analysts warn that the threat is still in the early stages of deployment, but its extensive target list raises concerns for institutions worldwide. Security teams are urged to monitor for the SORVEPOTEL worm’s activity and block known TCLBANKER indicators, such as malicious file hashes and suspicious network traffic patterns. Early detection and containment are critical, as the malware’s ability to exfiltrate sensitive data could lead to significant financial losses and reputational damage for affected organizations.

The discovery of TCLBANKER underscores the growing sophistication of cybercriminals in the financial sector. By leveraging widely used communication platforms for distribution, the attackers can bypass traditional security controls and reach a broader audience. The incident highlights the need for continuous threat intelligence sharing and robust endpoint protection, especially for institutions that handle high volumes of digital transactions. As the threat landscape evolves, cybersecurity professionals must remain vigilant and adapt their defenses to counter emerging malware families like TCLBANKER.