Loading story…
Researchers reported a renewed wave of TrickMo Android malware activity, showing that the banking trojan has evolved from its earlier role in German banking fraud into a broader mobile credential- and data-theft platform. First associated with campaigns that pushed a fake security app to bank customers in Germany to intercept transaction authentication numbers and bypass 2FA, newer 2023 samples were found masquerading as apps including Google Chrome and OnStream while continuing to abuse Android Accessibility Services to control infected devices and steal sensitive information.
The latest variants replaced earlier screen-recording behavior with HTML/WebView overlay attacks designed to capture credentials from banking, cryptocurrency, email, commerce, and social media apps. Analysts said the malware communicates with a command-and-control server at keepass[.]ltd (194.169.175[.]138), uses JsonPacker obfuscation, and now supports 45 commands covering SMS interception, call-log collection, photo and video exfiltration, USSD dialing, icon changes, runtime module downloads, and automated tapping via clicker.json; its Android tradecraft also aligns with ATT&CK technique T1624.001 for event-triggered execution through broadcast receivers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers detected another TrickMo sample on VirusTotal on November 11, 2023. The sample's SHA256 hash was reported as 55554c599507947c5eb96264a7db9acaa65d2b42742b39b15686836d0fac2ba0.
A further TrickMo sample was detected on VirusTotal on October 17, 2023. The report lists its SHA256 hash as a03c968ed6f639f766cf562493a90ae7a61e909d99e098aea2abbbf607003337.
Cyble Research and Intelligence Labs identified a new TrickMo variant via VirusTotal Intelligence in September 2023. This discovery marked renewed activity after a quieter period.
From July 2021 through 2022, only six TrickMo samples were identified, including two new variants supporting 40 commands. The period was characterized in the report as relatively low activity.
By July 2021, updated TrickMo variants had adopted overlay attacks as their primary credential-theft technique instead of the earlier screen-recording approach. This marked a notable evolution in the malware's collection methods.
In March 2020, IBM researchers analyzed TrickMo as a newly discovered Android banking trojan targeting users in Germany. The early known iteration used screen-recording functionality to steal sensitive information.
TrickMo, an Android banking trojan, was first identified in September 2019 and was disseminated through TrickBot malware. Early activity focused on stealing Transaction Authentication Numbers (TANs) from users in Germany.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyble.com
Open sourceattack.mitre.org
Open sourcesecurityintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **TrickMo** Android banking trojan variant is targeting banking, fintech, wallet, and authenticator app users in **France, Italy, and Austria**, with campaigns distributing the malware through fake **TikTok** and streaming apps promoted on social media. Researchers said the strain is a major platform redesign of the existing malware rather than a new family, preserving TrickMo’s core device-takeover features after accessibility abuse, including phishing overlays, keylogging, screen recording and streaming, SMS and notification interception, OTP suppression, clipboard manipulation, screenshot capture, and full remote control. The most significant change is TrickMo’s migration of command-and-control traffic from conventional internet infrastructure to **The Open Network (TON)** using `.adnl` endpoints and an embedded local TON proxy, making tracing and takedowns more difficult. The malware also adds network-reconnaissance and tunneling functions that let attackers use compromised Android devices as programmable traffic-exit nodes, including support for SSH port forwarding and authenticated **SOCKS5** proxying, alongside commands such as `curl`, DNS lookup, ping, traceroute, telnet, and HTTP probing. Researchers also found dormant components tied to the **Pine** hooking framework and declared **NFC** permissions, indicating preparation for future capabilities.
Jun 29, 2026
Researchers identified **OverlayPhantom**, a previously undocumented Android banking trojan distributed through malicious URLs that impersonate trusted apps including Austria’s **ID Austria** and **TikTok**. The malware uses a two-stage infection chain: a dropper installs a payload disguised as **Google Play Services**, then abuses Android **Accessibility Service** to gain persistent control of the device. Investigators said the campaign has been active since early May 2025 and is aimed at large-scale financial fraud across Western markets. OverlayPhantom targets more than **180 banking, financial, and cryptocurrency applications** across **10 countries**, using embedded HTML overlay phishing pages to steal credentials and payment data. The malware also leverages Android’s **MediaProjection API** for near-real-time JPEG screen streaming and supports more than **30 remote commands**, including gesture simulation, clipboard manipulation, fake notifications, device locking, and PIN or password capture. Its command-and-control infrastructure was tied to `199.217[.]99[.]122`, using non-standard ports `9091`, `9092`, and `9090` for command execution, device reporting, and screen streaming.
Jun 29, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026