TCLBANKER Trojan Spreads via Compromised Messaging Accounts, Linked to Known Malware Family

A new malware campaign labeled REF3076 has been identified, spreading the TCLBANKER trojan through victims' own messaging accounts. Researchers have linked this threat to the MAVERICK/SORVEPOTEL malware family based on shared infrastructure and code patterns.

The trojan disguises itself as a legitimate Logi AI Prompt Builder installer, distributed via ZIP files. It employs DLL sideloading techniques to execute malicious files masquerading as Flutter plugins. Once activated, the malware deploys two protected payloads: a banking module for financial theft and a worm module designed for self-propagation across systems.

Security analysts face significant obstacles in investigating TCLBANKER. The loader constructs a three-part fingerprint involving anti-debugging checks, system resource analysis, and language settings. This fingerprint generates decryption keys for embedded payloads, with failure conditions triggering silent termination if sandbox environments or debugging tools are detected.