MEDIUMMalware
Global

New TCLBanker malware self-spreads over WhatsApp and Outlook

·Source: BleepingComputer

Updated:

Executive Summary

A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems. [...]

Analysis

A new trojan named TCLBanker, which targets 59 banking, fintech, and cryptocurrency platforms, uses a trojanized MSI installer for Logitech AI Prompt Builder to infect systems. [...]
Source Attribution

Originally published by BleepingComputer on May 7, 2026.

Related Threats

MEDIUMMalware

Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools

Unit 42 analyzes AD CS exploitation through template misconfigurations and shadow credential misuse while offering behavioral detection for defenders. The post Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools appeared first on Unit 42 .

Unit 42 (Palo Alto)
MEDIUMMalware

TrickMo Variant Routes Android Trojan Traffic Through TON

ThreatFabric finds new TrickMo Android banking trojan variant routing C2 through The Open Network

Infosecurity Magazine
MEDIUMMalware

TrickMo Android banker adopts TON blockchain for covert comms

A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications. [...]

BleepingComputer