Loading story…
A new TrickMo Android banking trojan variant is targeting banking, fintech, wallet, and authenticator app users in France, Italy, and Austria, with campaigns distributing the malware through fake TikTok and streaming apps promoted on social media. Researchers said the strain is a major platform redesign of the existing malware rather than a new family, preserving TrickMo’s core device-takeover features after accessibility abuse, including phishing overlays, keylogging, screen recording and streaming, SMS and notification interception, OTP suppression, clipboard manipulation, screenshot capture, and full remote control.
The most significant change is TrickMo’s migration of command-and-control traffic from conventional internet infrastructure to The Open Network (TON) using .adnl endpoints and an embedded local TON proxy, making tracing and takedowns more difficult. The malware also adds network-reconnaissance and tunneling functions that let attackers use compromised Android devices as programmable traffic-exit nodes, including support for SSH port forwarding and authenticated SOCKS5 proxying, alongside commands such as curl, DNS lookup, ping, traceroute, telnet, and HTTP probing. Researchers also found dormant components tied to the Pine hooking framework and declared NFC permissions, indicating preparation for future capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
ThreatFabric reported a new 2026 TrickMo variant, assessed as a major platform overhaul rather than a new malware family, while noting it retains core device-takeover capabilities such as accessibility abuse, phishing overlays, keylogging, screen streaming, SMS interception, and remote control. The researchers also observed dormant Pine hooking components and NFC-related permissions suggesting preparation for future features.
The 2026 variant introduced reconnaissance and tunneling functions including DNS lookup, ping, traceroute, HTTP probing/curl, SSH tunneling and port forwarding, and authenticated SOCKS5 proxying. These additions allow infected Android devices to act as programmable traffic-exit nodes for fraud and evasion.
In the 2026 campaign, TrickMo's operators migrated primary command-and-control communications from conventional internet infrastructure to The Open Network using .adnl endpoints and an embedded local TON proxy. This architectural change improved stealth and resilience against tracing and takedown.
Between January and February 2026, operators ran campaigns using a new TrickMo variant against banking and cryptocurrency wallet users in France, Italy, and Austria. The malware was distributed via fake TikTok and streaming-themed Android apps, including a deceptive app named "Live Streaming," promoted through Facebook campaigns.
In October 2024, prior research by Zimperium reported 40 TrickMo variants delivered through 16 droppers and supported by 22 distinct command-and-control infrastructures, showing the malware's continued development before the 2026 redesign.
The TrickMo Android banking trojan was first seen in the wild in 2019, establishing the malware family later associated with banking credential theft and device takeover activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethreatfabric.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a renewed wave of **TrickMo** Android malware activity, showing that the banking trojan has evolved from its earlier role in German banking fraud into a broader mobile credential- and data-theft platform. First associated with campaigns that pushed a fake security app to bank customers in Germany to intercept transaction authentication numbers and bypass **2FA**, newer 2023 samples were found masquerading as apps including **Google Chrome** and **OnStream** while continuing to abuse Android **Accessibility Services** to control infected devices and steal sensitive information. The latest variants replaced earlier screen-recording behavior with **HTML/WebView overlay attacks** designed to capture credentials from banking, cryptocurrency, email, commerce, and social media apps. Analysts said the malware communicates with a command-and-control server at `keepass[.]ltd` (`194.169.175[.]138`), uses **JsonPacker** obfuscation, and now supports **45 commands** covering SMS interception, call-log collection, photo and video exfiltration, USSD dialing, icon changes, runtime module downloads, and automated tapping via `clicker.json`; its Android tradecraft also aligns with ATT&CK technique **`T1624.001`** for event-triggered execution through broadcast receivers.
Aug 15, 2026
Researchers identified **OverlayPhantom**, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s **ID Austria** and **TikTok**. The malware uses a two-stage infection chain: a dropper installs a payload disguised as **Google Play Services**, then abuses Android **Accessibility Service** to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets. OverlayPhantom targets more than **180 banking, financial, and cryptocurrency applications** across **10 countries**, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s **MediaProjection API** for near-real-time JPEG screen streaming and supports more than **30 remote commands**, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to `199.217[.]99[.]122`, using non-standard ports `9091`, `9092`, and `9090` for command execution, device reporting, and screen streaming.
Jun 29, 2026
The Android banking trojan **TgToxic** has evolved from a Southeast Asia-focused malware operation into a broader campaign targeting victims in Europe and Latin America, while continuing to steal banking credentials, cryptocurrency, and funds. Earlier reporting tied TgToxic to phishing and scam-themed lures delivered through malicious websites and messaging apps such as WhatsApp and Viber, where victims were pushed to install fake Android apps and grant dangerous permissions that enabled attackers to take automated control of infected devices. Recent analysis found the operators significantly upgraded the malware’s resilience and evasion. A second variant observed in late 2024 hid encrypted command-and-control data behind dead-drop resolvers on 25 community forums, and a third variant shifted to a **domain generation algorithm (DGA)** to make disruption harder. Newer samples also introduced stronger anti-emulation and anti-analysis checks, including hardware fingerprinting, Android feature validation, and emulator artifact detection, reinforcing assessments that the operators are actively adapting the trojan in response to public reporting and defensive scrutiny.
Aug 15, 2026