> TritonInfoSec News
Home / May 08, 2026 / Story
0
#10 BleepingComputer general May 07, 2026 at 22:06 UTC

New TCLBanker malware self-spreads over WhatsApp and Outlook

By Bill Toulas

AI Summary

A new banking trojan dubbed TCLBanker — delivered via a trojanized MSI installer disguised as the Logitech AI Prompt Builder — targets 59 banking, fintech, and cryptocurrency platforms and self-propagates through WhatsApp and Outlook. The use of a legitimate software installer as a lure and self-spreading via enterprise communication tools gives this malware significant reach in corporate environments. Security teams should add TCLBanker IOCs to detection rules and scrutinize MSI installer downloads from unofficial sources.

Read full article → https://www.bleepingcomputer.com/news/security/new…

Relevance score: 72.0/100

# More from May 08

  1. 1
    PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage The Hacker News
  2. 2
    Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access The Hacker News
  3. 3
    Canvas Breach Disrupts Schools & Colleges Nationwide Krebs on Security
  4. 4
    Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions The Hacker News
  5. 5
    PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems The Hacker News
  6. 6
    Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants SecurityWeek
  7. 7
    Iranian government hackers using Chaos ransomware as cover, researchers say The Record
  8. 8
    Critical vm2 sandbox bug lets attackers execute code on hosts BleepingComputer
  9. 9
    DAEMON Tools devs confirm breach, release malware-free version BleepingComputer