Signed Logitech Installer Abused to Drop TCLBANKER Banking Trojan

Gbhackers •Mayura Kathir • May 8, 2026

Hackers are abusing a signed Logitech installer to stealthily deploy a new Brazilian banking trojan known as TCLBANKER, giving threat actors a powerful tool to steal financial data and self‑propagate through popular communication platforms. The malware specifically targets Brazilian users and focuses on 59 banking, fintech, and cryptocurrency websites, activating only when victims browse to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TCLBANKER Trojan Targets Brazilian Financial Sector via Logitech Installer A new banking trojan named TCLBANKER has emerged, targeting 59 Brazilian banking, fintech, and cryptocurrency platforms. Discovered by Elastic Security Labs, the malware utilizes a trojanized MSI installer of Logitech's AI Prompt Builder to infect systems stealthily. It features self-propagating worm modules that spread through WhatsApp and Outlook, hijacking authenticated sessions to message contacts and send phishing emails. The malware is designed to evade detection with robust anti-analysis techniques, including environment-dependent payloads and a persistent watchdog to eliminate debugging tools. Currently, the threat is primarily focused on Brazilian users, but there is potential for it to expand its targeting scope. The campaign is tracked as REF3076, and the malware's capabilities include monitoring browser activity and deploying fraudulent overlays to steal sensitive information. 8 sources 70

Extracted Entities

Signed Logitech Installer Abused to Drop TCLBANKER Banking Trojan

The full story

Extracted Entities

Attack Types (2)

Industries (1)

Malware (1)

Tools (1)