TCLBanker Malware Spreads via WhatsApp and Outlook

Emily Davis · 2026-05-07

A new banking trojan called TCLBanker is making the rounds, and it's not your average malware. This one targets 59 different banking, fintech, and cryptocurrency platforms, and it's got a clever disguise: a trojanized MSI installer for Logitech AI Prompt Builder. Once you download that fake installer, the malware sneaks into your system and starts stealing your credentials. What makes TCLBanker especially dangerous is how it spreads. It doesn't just sit and wait for you to click a link. Instead, it uses your own WhatsApp and Outlook accounts to send itself to your contacts. That means your friends, coworkers, or clients might get a message from you that looks legit but actually contains the malware. It's a social engineering nightmare. ### How Does the Infection Happen? The attack starts with a malicious MSI file disguised as a legitimate Logitech AI Prompt Builder installer. You might receive this file via email, a messaging app, or even a shared link. Once you run it, the installer drops the TCLBanker trojan onto your system. From there, it quietly monitors your activity, looking for login pages from 59 specific financial platforms. - It captures keystrokes and form data. - It takes screenshots of your banking sessions. - It exfiltrates credentials and session tokens. All this happens in the background, so you might not notice anything wrong until your bank account is drained.  ### Why WhatsApp and Outlook? TCLBanker's self-spreading capability is its most troubling feature. After infecting your system, it accesses your WhatsApp Web session and your Outlook email client. Then it sends messages to your contacts with links to download the same fake Logitech installer. This creates a chain reaction where one infection can lead to dozens more. Think about it: if you get a message from a trusted colleague saying "Hey, check out this new Logitech tool," you're much more likely to click. That's exactly what the attackers are counting on.  ### Who Is at Risk? This malware primarily targets users in the United States who use online banking, fintech apps, or cryptocurrency exchanges. If you manage multiple accounts or handle large transactions, you're a high-value target. But honestly, anyone with a bank account and a computer could be affected. ### How to Protect Yourself Here are some practical steps to stay safe: - **Verify downloads**: Always download software from the official vendor's website. If someone sends you an installer, double-check its source. - **Enable two-factor authentication**: This adds an extra layer of security even if your credentials are stolen. - **Be wary of unexpected messages**: If a contact sends you a file or link out of the blue, call them to confirm. - **Use an antidetect browser**: These tools help mask your digital fingerprint, making it harder for malware to track your online activity. For example, the best antidetect browsers can isolate your sessions and prevent credential theft. - **Keep your software updated**: Regular updates patch vulnerabilities that malware exploits. ### The Bottom Line TCLBanker is a reminder that cyber threats are getting more sophisticated. It's not just about protecting your passwords anymore. It's about being cautious with every link, every download, and every message you receive. Stay vigilant, and don't let a fake Logitech installer ruin your day.