Full Report
A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems. [...]
Analysis Summary
# Tool/Technique: TCLBanker
## Overview
TCLBanker is a sophisticated Brazilian banking trojan discovered in early 2026. It is considered an evolution of the Maverick/Sorvepotel malware family. Its primary purpose is to facilitate financial fraud by targeting banking, fintech, and cryptocurrency platforms. The malware is notable for its use of trojanized legitimate software installers (Logitech AI Prompt Builder), DLL side-loading for stealth, and autonomous worm modules for self-propagation via WhatsApp and Microsoft Outlook.
## Technical Details
- **Type:** Malware family (Banking Trojan / Worm)
- **Platform:** Windows (Targeting Chromium-based browsers, WhatsApp Web, and Outlook)
- **Capabilities:** Web monitoring, Remote Access Trojan (RAT) features, Screen overlay injection, Clipboard hijacking, and Self-propagation.
- **First Seen:** May 2026 (Reported by Elastic Security Labs)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0003 - Persistence]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- **[TA0005 - Defense Evasion]**
- [T1140 - Deobfuscate/Decode Files or Information]
- [T1497 - Virtualization/Sandbox Evasion]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- **[TA0007 - Discovery]**
- [T1010 - Application Window Discovery]
- [T1082 - System Information Discovery]
- **[TA0009 - Collection]**
- [T1115 - Clipboard Data]
- [T1056.001 - Input Capture: Keylogging]
- [T1185 - Browser Session Hijacking]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols (WebSockets)]
## Functionality
### Core Capabilities
- **Browser Monitoring:** Uses Windows UI Automation APIs to monitor the browser address bar every second for targeted financial URLs.
- **Remote Access (RAT):** Provides operators with live screen streaming, remote mouse/keyboard control, shell command execution, and file system access.
- **Overlay Attacks:** Utilizes a WPF-based system to inject "fake" windows (PIN pads, credential prompts, wait screens) over legitimate banking sites to harvest credentials.
- **Stealth Execution:** Loads via DLL side-loading within a legitimate Logitech application to bypass security software.
### Advanced Features
- **WhatsApp Worm:** Accesses Chromium IndexedDB data to hijack WhatsApp Web sessions, harvesting contacts and sending automated phishing messages to new victims.
- **Outlook Worm:** Uses COM automation to control the Microsoft Outlook application, harvesting email addresses and sending phishing emails from the victim's account.
- **Anti-Analysis Watchdog:** Actively hunts for and terminates analysis tools including x64dbg, IDA, dnSpy, Frida, ProcessHacker, and Ghidra.
- **Environment Dependency:** Payloads use decryption routines that require specific environment markers, causing failure in sandboxes or automated analysis environments.
## Indicators of Compromise
- **File Names:** `LogiAIInstaller.msi` (Trojanized Logitech installer), legitimate Logitech executables used for side-loading.
- **Network Indicators:** WebSocket communication for C2 (e.g., `wss[:]//[attacker_domain]`).
- **Behavioral Indicators:**
- Termination of `taskmgr.exe` during active sessions.
- Rapid, automated access to `IndexedDB` folders in Chromium profiles.
- Unexpected `COM` automation calls to `Outlook.exe`.
- Constant polling of Windows UI Automation APIs.
## Associated Threat Actors
- Currently attributed to Brazilian cybercriminals (based on code artifacts, keyboard layout checks, and locale targeting). The evolution suggests ties to previous **Maverick/Sorvepotel** campaigns.
## Detection Methods
- **Signature-based:** Monitoring for known malicious DLLs associated with the Logitech AI Prompt Builder side-loading chain.
- **Behavioral detection:**
- Monitoring for processes checking for the presence of multiple debugger/analysis tools simultaneously.
- Alerting on unauthorized access to browser-stored session databases (IndexedDB).
- Detecting unusual WebSocket traffic from non-browser processes.
- **YARA rules:** Rules targeting the unique WPF overlay strings and the anti-analysis watchdog loop logic.
## Mitigation Strategies
- **Prevention:** Block the execution of unsigned or unexpectedly signed MSI installers. Implement application whitelisting.
- **Hardening:** Use EDR solutions to monitor for DLL side-loading in trusted application directories. Disable COM automation for Outlook where not required by business needs.
- **User Education:** Advise users against downloading software from unofficial links sent via WhatsApp or email, even from known contacts.
## Related Tools/Techniques
- **Maverick / Sorvepotel:** The predecessor malware family.
- **Grandoreiro:** Another prominent LATAM banking trojan using similar overlay and side-loading techniques.
- **DLL Side-loading:** The primary execution method.