TCLBANKER (REF3076): Brazilian Banking Trojan Evolves with WhatsApp/Outlook Worms
Has anyone dug into the latest Elastic Security Labs report on REF3076 (TCLBANKER)? It looks like the old "Maverick" banking trojan just got a significant facelift. What is particularly worrying is the reintroduction of the SORVEPOTEL worm capabilities to propagate via WhatsApp and Outlook.
This variant is aggressively targeting 59 specific banking, fintech, and crypto platforms. The worm component implies that a single compromised machine can quickly pivot to infect a victim's contact list, making containment a nightmare for SOC teams.
Relying on static signatures is usually pointless here given the obfuscation levels typical of Brazilian banking trojans. We need to focus on behavioral anomalies. Specifically, we should be hunting for legitimate communication apps spawning unauthorized shells or script interpreters.
Here is a basic KQL query I’m using to hunt for parent/child process anomalies involving Outlook and WhatsApp Desktop:
process where host.os.type == "windows" and
process.parent.name in ("outlook.exe", "WhatsApp.exe") and
process.name in ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe") and
not process.executable : @"C:\Windows\System32\*" and
not process.command_line contains "--type=renderer"
I'm also curious if anyone has identified persistence mechanisms other than Registry Run keys yet? Given the scope of targets, are we seeing a shift back to endpoint worms after the ransomware hype?
Solid query. We've started monitoring for AccessibilityService usage on mobile devices since that's how the overlays typically work to capture OTPs. On the Windows side, we are seeing more attempts to inject into explorer.exe to hide the window. I'd also suggest monitoring for unexpected COM object creation by these apps, often used to bypass Outlook security warnings silently.
The social engineering angle here is the real killer. If you get a message on WhatsApp from a compromised "friend," you click it without thinking. Standard perimeter defenses fail here. I've tested similar samples that abuse WhatsApp Web APIs to send themselves. We really need to enforce strict OAuth app policies for consumer accounts in corporate environments to stop the spread.
We actually blocked the WhatsApp desktop executable entirely via AppLocker last year after a different phishing campaign. It caused some pushback from the sales team, but it stopped this vector cold. For Outlook, we've disabled HTML rendering and auto-downloads for external senders. It's heavy-handed, but it's effective against these worms.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access