Hackers Abuse Signed Logitech Installer to Deploy TCLBANKER Banking Trojan

Cybersecuritynews •Tushar Subhra Dutta • May 8, 2026

A new banking trojan known as TCLBANKER has been quietly making rounds, and its delivery method is as clever as it is concerning. Attackers are using a trojanized version of a legitimate, digitally signed installer to slip malware onto victims’ machines without raising immediate suspicion. The campaign, tracked as REF3076, bundles a malicious MSI installer […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TCLBANKER Trojan Targets Brazilian Financial Sector via Logitech Installer A new banking trojan named TCLBANKER has emerged, targeting 59 Brazilian banking, fintech, and cryptocurrency platforms. Discovered by Elastic Security Labs, the malware utilizes a trojanized MSI installer of Logitech's AI Prompt Builder to infect systems stealthily. It features self-propagating worm modules that spread through WhatsApp and Outlook, hijacking authenticated sessions to message contacts and send phishing emails. The malware is designed to evade detection with robust anti-analysis techniques, including environment-dependent payloads and a persistent watchdog to eliminate debugging tools. Currently, the threat is primarily focused on Brazilian users, but there is potential for it to expand its targeting scope. The campaign is tracked as REF3076, and the malware's capabilities include monitoring browser activity and deploying fraudulent overlays to steal sensitive information. 8 sources 70

Extracted Entities

Hackers Abuse Signed Logitech Installer to Deploy TCLBANKER Banking Trojan

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)