New TCLBANKER trojan just exposed targeting 59 banks—and it spreads through your WhatsApp messages

Threat hunters at Elastic Security Labs have uncovered a previously unknown Brazilian banking trojan that weaponizes WhatsApp and Outlook to silently compromise users targeting 59 banking, fintech, and cryptocurrency platforms worldwide.

The malware, dubbed TCLBANKER and tracked internally as REF3076, represents a significant escalation in how financial trojans spread. Unlike earlier variants that relied on traditional infection vectors, this strain exploits the ubiquity of messaging apps—tools billions of people trust daily—to distribute itself globally. The discovery underscores a growing vulnerability: the platforms we use to communicate have become distribution channels for sophisticated financial malware.

Elastic Security Labs identified TCLBANKER as a major update to Maverick, a known banking trojan family. The malware leverages a worm component called SORVEPOTEL to propagate across networks. By weaponizing WhatsApp and Outlook, the trojan gains a critical advantage: it can spread through contact lists and message threads, reaching victims who may have no direct connection to the initial infection source. A user who receives what appears to be a legitimate message from a trusted contact could unknowingly download the malware.

The scope of financial targets is broad. The 59 platforms identified by Elastic Security Labs span traditional banks, emerging fintech services, and cryptocurrency exchanges. This diversity suggests the attackers are casting a wide net, maximizing potential victims across multiple financial sectors and geographies. The inclusion of cryptocurrency platforms is particularly notable, as these services often have fewer regulatory protections and may attract users seeking privacy—making them attractive targets for financially motivated threat actors.

How Does TCLBANKER Bypass Traditional Security Measures?

What makes TCLBANKER particularly dangerous is its stealth architecture. Banking trojans of this class are designed to intercept credentials, capture two-factor authentication codes, monitor transactions, and exfiltrate sensitive financial data without triggering obvious user-facing alerts. The victim may notice nothing amiss while their account is being drained or their identity is being exploited for fraudulent transfers. Understanding two-factor authentication vulnerabilities becomes crucial when malware can intercept these supposedly secure codes.

The use of WhatsApp and Outlook as distribution vectors is a deliberate choice by the attackers. Both platforms have massive user bases and high levels of user trust. A WhatsApp message appearing to come from a friend or colleague is far more likely to be opened than an email from an unknown sender. Outlook, similarly, benefits from enterprise trust—many users assume messages from their corporate email system are safe. By compromising these channels, TCLBANKER operators can bypass traditional email security filters and user skepticism simultaneously.

Why Are Messaging Platforms Becoming Malware Distribution Channels?

Elastic Security Labs’ identification of this threat represents the kind of continuous monitoring that catches emerging malware before it reaches massive scale. However, the fact that TCLBANKER was previously undocumented suggests it may have been circulating undetected for some time. The number of victims currently compromised remains unknown, as does the geographic distribution of infections.

The discovery also highlights a fundamental asymmetry in cybersecurity: legitimate communication platforms are optimized for ease of use and speed, not security verification. WhatsApp and Outlook prioritize seamless messaging over cryptographic verification that would alert users to spoofed or compromised sender accounts. While end-to-end encryption protects message content in transit, it does nothing to prevent a compromised device from sending malicious links to a user’s entire contact list. This reality challenges assumptions about messaging app privacy when the threat comes from within trusted networks.

What Should Users Do to Protect Their Financial Accounts?

For users of these platforms, the implications are clear but difficult to act on. The malware spreads through seemingly legitimate messages from people you know. Traditional advice—don’t click suspicious links—becomes less effective when the link comes from your mother, your coworker, or your bank’s support team. Attackers can compromise one account and use it to target dozens more, creating a cascading infection pattern.

Financial institutions targeted by TCLBANKER have not yet issued public warnings in widely available statements, though Elastic Security Labs’ disclosure will likely prompt coordinated responses from affected banks and fintech platforms. Users of the 59 identified platforms should monitor their accounts for unauthorized activity, enable transaction alerts if available, and consider changing passwords from a clean, uncompromised device.

The emergence of TCLBANKER also signals that banking trojans continue to evolve faster than many users’ security practices. As messaging apps become the primary communication channel for billions of people, they become increasingly attractive targets for malware distribution. The next phase of this threat will depend on how quickly affected financial institutions can notify their users and whether platform operators implement additional verification mechanisms for sensitive file transfers and links.