TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms
2026-05-09T01:24:06Z•0662bdd0931492f878b331b416cb25d186ab94d757e1b376825f120847c4da11
DAEMON-ToolsDirty-FragIvanti-EPMMMirai-botnet','IoT-DDoS'PAM-modulePAN-OSPCPJackPamDOORaPyPI-malwareQuasarRATTCLBANKERZiChatBotbanking-trojancloud-credential-theftcredential-theftfake-appsgoogle-playkernel-exploitlinux-lpemobile-fraudsandbox-escapesupply-chainvm2-vulnerabilitiesworm
What happened
Multiple active and emerging threats observed across platforms: a new Brazilian banking trojan (TCLBANKER) with worm-like spread, widespread fraudulent Android Play Store apps stealing subscription payments, developer-targeting Linux implants (Quasar/QLNX) and PAM-based backdoor (PamDOORa) for SSH persistence, a new unpatched Linux kernel local privilege escalation (Dirty Frag), and several actively exploited high-severity product flaws (Palo Alto PAN-OS and Ivanti EPMM). Supply-chain compromises (DAEMON Tools, PyPI packages delivering ZiChatBot), critical library sandbox-escape flaws (vm2), a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 0662bdd0931492f878b331b416cb25d186ab94d757e1b376825f120847c4da11
- Enrichment time
- 2026-05-09T01:24:06Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.