TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms
2026-05-08T19:24:13Z•c92f074ca84ce2d5398fc5ba4e4bcba9a6171045389253de17351c709d0a8273
active-exploitationai-agent-riskandroid-fraudapache-http2banking-trojanbotnetcredential-theftdevops-targetingdirty-fragivanti-epmmlinux-lpemiraipamdoorApan-ospcpjackplay-store-fraudpyPI-malwarequasar-ratsecurity-operationssupply-chain-attacktclbankervm2-nodejswormxlabs_v1
What happened
A broad set of active and emerging threats: a new Brazilian banking trojan (TCLBANKER) with worm-capabilities targeting financial and crypto platforms; fraudulent Android Play Store apps stealing payments; several developer- and supply-chain-focused implants (Quasar Linux RAT, ZiChatBot via PyPI, DAEMON Tools installer compromise); new Linux post-exploitation/backdoor and local privilege-escalation issues (PamDOORa, Dirty Frag LPE); credential-stealing frameworks and worm-like cloud spread (PCPJack); and multiple high-severity remote code execution flaws being actively exploited (Palo Alto PAN
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- c92f074ca84ce2d5398fc5ba4e4bcba9a6171045389253de17351c709d0a8273
- Enrichment time
- 2026-05-08T19:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.