New Brazilian Banking Trojan TCLBANKER Targets Financial Apps Through Messaging Worms

Overview of the TCLBANKER Threat

Cybersecurity researchers have uncovered a previously undocumented banking trojan originating from Brazil, now being tracked as TCLBANKER. This malicious software is designed to compromise a wide range of financial platforms, including banking, fintech, and cryptocurrency services. According to Elastic Security Labs, the campaign has been assigned the internal identifier REF3076. Analysts believe TCLBANKER represents a significant evolution of the earlier Maverick malware family, incorporating a self-replicating worm component known as SORVEPOTEL that spreads via popular communication tools like WhatsApp and Outlook.

Financial institutions and their customers are urged to remain vigilant as the trojan's distribution methods become more sophisticated. This article breaks down the technical details, infection vectors, targets, and recommended countermeasures.

Technical Details and Evolution

TCLBANKER is assessed to be a major update of the Maverick malware, a known Brazilian banking trojan that has been active in the wild. The new version introduces enhanced capabilities, including a modular architecture that allows it to adapt to different environments and evade detection. The malware family is specifically crafted to steal credentials, session tokens, and other sensitive information from financial applications.

One of the key improvements is the integration of the SORVEPOTEL worm. This worm component is responsible for the autonomous spread of TCLBANKER by abusing legitimate messaging and email platforms. Rather than relying solely on phishing links or malicious downloads, the worm can replicate itself and infect new victims through social engineering within trusted communication channels.

Infection Vector: WhatsApp and Outlook Worms

The primary distribution method for TCLBANKER involves the SORVEPOTEL worm, which leverages two widely used platforms: WhatsApp and Microsoft Outlook. Once a system is compromised, the worm scans the victim's contact lists and sends malicious messages or emails containing download links or attachments. These messages often mimic legitimate communications, such as invoices, payment confirmations, or security alerts, to trick recipients into clicking.

For WhatsApp, the worm can send automated messages with embedded links that lead to fake login pages or directly download the trojan. In the case of Outlook, the worm creates persuasive emails that appear to come from trusted sources, using social engineering to bypass human suspicion. This dual-vector approach significantly increases the reach and infection rate of the malware.

Target Platforms and Geographic Focus

Threat intelligence indicates that TCLBANKER is capable of targeting 59 distinct banking, fintech, and cryptocurrency platforms. While the exact list of affected services is not publicly disclosed, the breadth of targets suggests that the attackers are aiming for broad financial disruption. The trojan is designed to inject malicious web overlays, capture keystrokes, and intercept two-factor authentication tokens, making it especially dangerous for mobile and web-based banking users.

Given its Brazilian origin, the initial focus is likely on Latin American financial institutions, but the worm's ability to spread globally through WhatsApp and Outlook means that victims anywhere with contacts in the region could be affected. Security teams in other countries should also be on high alert.

Mitigation and Prevention Strategies

Defending against TCLBANKER requires a multi-layered approach:

• User Education: Train employees and customers to recognize suspicious messages on WhatsApp and Outlook, especially unsolicited links or attachment requests from known contacts. Verify through a secondary channel before clicking.
• Endpoint Protection: Deploy advanced anti‑malware solutions that can detect behavioral anomalies associated with banking trojans and worm propagation. Keep signatures and detection rules up to date.
• Email and Messaging Security: Implement filtering and sandboxing for email attachments and links. For WhatsApp, consider using enterprise‑grade security tools that monitor for unusual messaging patterns.
• Network Segmentation: Limit the ability of malware to spread laterally. Isolate critical financial systems from general user workstations.
• Regular Backups: Maintain offline backups of important data to facilitate recovery in case of infection.
• Multi‑Factor Authentication: Use hardware‑based or app‑based MFA instead of SMS‑based tokens, which can be intercepted by the trojan.

Conclusion

The emergence of TCLBANKER highlights the continued evolution of banking trojans from Brazil, a region known for prolific cybercrime groups specializing in financial fraud. By combining a sophisticated modular trojan with a worm that spreads through everyday communication tools, the attackers have created a potent threat. Organizations and individuals should adopt proactive security measures and stay informed about ongoing campaigns like REF3076. As the threat landscape shifts, cooperation between security researchers and financial platforms will be critical to mitigating the impact of such malware.

For further reading on related threats, see our section on infection vectors above, or explore up‑to‑date advisories from Elastic Security Labs.