TCLBANKER Targets 59 Financial Platforms and Spreads via WhatsApp and Outlook
Summary
Elastic Security Labs describes TCLBANKER, a Brazilian banking trojan targeting 59 financial platforms. It uses anti-analysis checks, browser monitoring and credential overlays, and spreads through hijacked WhatsApp sessions and Outlook accounts.
Key points
- Elastic Security Labs tracks the activity as REF3076 and assesses TCLBANKER as a major update of Maverick; Trend Micro attributes the Maverick campaign to Water Saci.
- The infection chain uses a malicious MSI in a ZIP file and DLL side-loading through a signed Logitech Logi AI Prompt Builder program.
- The loader checks for analysis tools, removes user-mode hooks, disables ETW telemetry, and uses system fingerprints—including a Brazilian Portuguese language check—to gate payload decryption.
- The banking trojan monitors browser URLs for targeted financial institutions and can use WebSocket commands for actions including keylogging, screenshots, remote control, and credential harvesting.
- A worm module spreads through hijacked WhatsApp Web sessions and sends phishing emails through victims’ Outlook accounts.
Article Details
- Attack Vectors
- A malicious MSI installer is bundled in a ZIP and abuses the signed Logi AI Prompt Builder program to DLL-side-load screen_retriever_plugin.dll.
- The loader checks for analysis tools, sandboxes, debuggers, disassemblers, instrumentation tools, and antivirus software; it also removes user-mode hooks in ntdll.dll and disables ETW telemetry.
- The loader derives an environment hash from anti-debugging and anti-virtualization checks, disk information, and system language, then uses it to decrypt the embedded payload. Execution is gated on Brazilian Portuguese language settings and a Brazilian system.
- The banking trojan establishes persistence with a scheduled task and sends system information to an external server in an HTTP POST request.
- A URL monitor reads the foreground browser’s address-bar URL and checks it against a hard-coded list of financial institutions; matches trigger a WebSocket connection used for remote commands and control.
- Remote capabilities include running shell commands, capturing screenshots, streaming the screen, manipulating the clipboard, keylogging, controlling mouse and keyboard, managing files and processes, and displaying credential-stealing overlays.
- The WhatsApp worm hijacks authenticated WhatsApp Web sessions, retrieves a messaging template from a server, and uses WPPConnect to message contacts while filtering out groups, broadcasts, and non-Brazilian numbers.
- An Outlook email bot sends fake phishing emails from victims’ accounts to their contacts.
- WPF-based full-screen overlays impersonate credential prompts, vishing wait screens, progress bars, and Windows Updates; the overlays are hidden from screen-capture tools.
- Defensive Notes
- The article reports that hijacked WhatsApp sessions and Outlook accounts lend malicious messages the trust and deliverability of legitimate communications, which it says traditional email gateways and reputation-based defenses may be ill-equipped to detect.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe banking trojan establishes persistence using a scheduled task.T1056.001 · KeyloggingThe trojan can launch a keylogger.T1057 · Process DiscoveryThe remote-control capabilities include enumerating running processes.T1059 · Command and Scripting InterpreterThe operator can use the trojan to run shell commands on the infected system.T1071.001 · Web ProtocolsThe trojan beacons to an external server with an HTTP POST request and uses a WebSocket connection for remote command dispatch.T1082 · System Information DiscoveryThe malware checks system disk information and sends basic system information to an external server.T1113 · Screen CaptureThe trojan can capture screenshots and start or stop screen streaming.T1115 · Clipboard DataThe trojan can manipulate the clipboard.T1185 · Browser Session HijackingThe WhatsApp worm hijacks authenticated WhatsApp Web sessions to send messages to victims’ contacts.T1497.001 · System ChecksThe loader uses anti-virtualization and environment checks to gate payload decryption and execution.T1562.001 · Disable or Modify ToolsThe loader disables ETW telemetry and removes user-mode hooks placed by endpoint security software in ntdll.dll.T1566 · PhishingThe Outlook bot sends fake phishing emails from victims’ accounts to their contacts.T1574.002 · DLL Side-LoadingThe malware DLL is loaded through DLL side-loading against the signed Logi AI Prompt Builder program.T1622 · Debugger EvasionThe loader checks for debuggers and produces an incorrect environment hash if one is present, preventing correct payload decryption.
People
Daniel StepanicNamed as a security researcher who described the observed infection chain and the abuse of the signed Logitech program.Jia Yu ChanNamed as a security researcher who described the observed infection chain and the abuse of the signed Logitech program.Seth GoodwinNamed as a security researcher who described the observed infection chain and the abuse of the signed Logitech program.Terrance DeJesusNamed as a security researcher who described the observed infection chain and the abuse of the signed Logitech program.
Threat Actors
Malware
Vendors
Products
BraveThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.Google ChromeThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.Logi AI Prompt Builder“These MSI installer packages are abusing a signed Logitech program called Logi AI Prompt Builder.”Microsoft EdgeThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.Microsoft OutlookIt also spreads through hijacked WhatsApp Web sessions and Microsoft Outlook accounts, combining credential theft, remote control, and social engineering to expand its reach.Mozilla FirefoxThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.OperaThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.VivaldiThis step targets popular browsers like Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and Vivaldi.WhatsAppIt also spreads through hijacked WhatsApp Web sessions and Microsoft Outlook accounts, combining credential theft, remote control, and social engineering to expand its reach.
Tools
Industries
BankingTCLBANKER is a newly identified Brazilian banking trojan that targets 59 banking, fintech, and cryptocurrency platforms while using advanced anti-analysis and environment-gating techniques to evade detection.CryptocurrencyTCLBANKER is a newly identified Brazilian banking trojan that targets 59 banking, fintech, and cryptocurrency platforms while using advanced anti-analysis and environment-gating techniques to evade detection.fintechTCLBANKER is a newly identified Brazilian banking trojan that targets 59 banking, fintech, and cryptocurrency platforms while using advanced anti-analysis and environment-gating techniques to evade detection.