Elastic Security LabsPublished
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
By Jia Yu Chan, Daniel Stepanic, Seth Goodwin, Terrance DeJesus
Excerpt
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis capabilities that deploys two embedded .NET Reactor-protected modules: a full-featured banking trojan and a worm module for self-propagation.
The banking trojan monitors the victim's browser address bar via UI Automation, targeting 59 Brazilian banking, fintech, and cryptocurrency domains. Beyond the usual remote access commands, its most…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Auditing the auditor: Unmasking Apex AcceleratorElastic Security Labs · Published 12 Oct
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RATElastic Security Labs · Published 14 Apr
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- Shedding light on the ABYSSWORKER driverElastic Security Labs · Published 20 Mar 2025
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
