TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

Reported 06 May 2026 by otx · Severity: medium

A sophisticated Brazilian banking trojan named TCLBANKER has been identified, representing a significant evolution of the MAVERICK/SORVEPOTEL malware family. The campaign employs a trojanized Logitech installer that deploys two .NET Reactor-protected modules through DLL side-load