TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family. The campaign, tracked as REF3076, features a loader with robust anti-analysis capabilities that deploys two embedded .NET Reactor-protected modules: a full-featured banking trojan and a worm module for self-propagation. The banking trojan monitors the victim's browser address bar via UI Automation, targeting 59…