A dangerous Android banking malware known as TrickMo has resurfaced with a powerful new variant, and this time it is more stealthy, more capable, and harder to stop than ever before. <\/p>\n
The threat is actively targeting users of banking apps, digital wallets, and authenticator applications across Europe, putting financial data and account access at serious risk.<\/a><\/p>\n The malware spreads through fake TikTok apps distributed via Facebook campaigns and a deceptive app disguised as \u201cLive Streaming.\u201d <\/p>\n Once installed, TrickMo tricks users into granting accessibility permissions, which then gives the attacker complete control over the device. From that point forward, the victim\u2019s phone essentially becomes a tool in the hands of a criminal operator.<\/a><\/p>\n Analysts at ThreatFabric identified and began tracking this new TrickMo variant<\/a> between January and February 2026, noting it as a deliberate platform overhaul rather than a completely new malware family. <\/p>\n Their Mobile Threat Intelligence Team observed active campaigns targeting banking and wallet customers in France, Italy, and Austria, with signs pointing to this new strain gradually replacing its older predecessor across operator campaigns.<\/p>\n What makes this version especially alarming is that it does not just steal credentials. It records screens, logs keystrokes, intercepts SMS messages, and silently suppresses one-time password notifications before the user ever sees them. The attacker can watch the screen live, replay gestures, and interact with the device in real time, making fraudulent transactions far harder to detect.<\/a><\/p>\n The new variant also transforms infected devices into programmable network nodes. Through built-in SSH tunnelling and an authenticated on-device SOCKS5 proxy, a compromised phone routes malicious traffic while appearing to originate from the victim\u2019s own network. This effectively tricks fraud detection systems at banks<\/a> and crypto exchanges into treating suspicious activity as entirely legitimate.<\/a><\/p>\n TrickMo is classified as Device Takeover malware, meaning it gives an attacker full interactive control over an infected phone. It achieves this by abusing Android\u2019s accessibility service, a built-in feature that, when misused, allows an app to read and interact with everything on screen.<\/p>\n Once active, TrickMo deploys fullscreen fake login pages that closely mimic real banking apps to deceive victims. While the user enters credentials into what they believe is their legitimate app, TrickMo captures every keystroke and sends the data to the attacker in the background.<\/a><\/p>\n The malware also intercepts and silently suppresses incoming SMS messages and push notifications, particularly those carrying one-time passwords. This means even two-factor authentication offers limited protection after a device is infected. Users have no visible sign that their messages are being quietly redirected.<\/a><\/p>\n Beyond credential theft, TrickMo loads a runtime module called dex.module that delivers its core remote-control engine. This module is fetched from attacker-controlled infrastructure and injected into the running process, making it harder for standard security scans to detect.<\/a><\/p>\n The most significant change in this new variant is how it communicates with operators. Previous versions relied on conventional internet infrastructure, making their command servers easier to locate and shut down. TrickMo now routes all communications through The Open Network, known as TON, a decentralised peer-to-peer overlay.<\/a><\/p>\n Instead of connecting to regular web addresses that can be traced and blocked, TrickMo uses .adnl endpoints resolved entirely within the TON network. These addresses do not exist in the public internet\u2019s address system, making traditional domain takedowns largely ineffective. Security teams cannot cut the connection the way they would with a standard malicious domain.<\/a><\/p>\n To further complicate detection, TrickMo replaces the device\u2019s DNS resolver with a DNS-over-HTTPS service for any remaining clearnet connections<\/a>. This hides the domains the malware queries from network monitoring tools. The traffic produced blends seamlessly with other legitimate TON activity, making it very difficult to spot at the network level.<\/a><\/p>\n Users can protect themselves by avoiding sideloaded apps, never granting accessibility permissions to unfamiliar applications, and keeping their Android devices regularly updated. <\/p>\n Financial institutions are strongly urged to deploy mobile threat detection capable of identifying anomalous accessibility usage and unusual outbound tunnelling behaviour on customer devices.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em> Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post TrickMo Android Banking Malware Targets Banking, Wallet, and Authenticator Apps<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"Features](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh2luVtuloL0wIYC0gFywtU5rlhbd5fGxvn0acKZ1AUc_ogY02auEA4CNnghfBZd4YzmO15tCMYFZWhWS2UG-SpR83mjqAyvOpH1Q_q2a_i-zW6Gl1pVs_MkzrJX5URXNvo9zNCxcp_yN9er4IlvFcbV88ItDZFjpLlc0sHTAVve5cXZZe0g5iLR35ZhVg\/s16000\/Features%2520%28Source%2520-%2520Threat%2520Fabric%29.webp?ssl=1\")
TrickMo\u2019s Expanding Attack Surface<\/strong><\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhDgXNXiwHx7dd_YlF1WQvuh0yF0MBWTCdldWFrsYRcyfw2_HPZ3S9YFEOXfN-09b0KUeNyMLPRJ073NR4qH-mVg3B72OE_UaV0unpxQcFxHdCTpsk_RXogBYuyK1FP2quwwUqIpyN87XHn8HBMlT4Pex69Wsv83n2nQZf9arGrb0Pn7WYFywSqHF1-P4w\/s16000\/Architecture%2520%28Source%2520-%2520Threat%2520Fabric%29.webp?ssl=1\")
Command-and-Control Through the TON Network<\/strong><\/h2>\n
\n\n
\n \nType<\/th>\n Indicator<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n \n SHA-256<\/td>\n 01889a9ec2abecb73e5e8792be68a4e3bc7dcbe1c3f19ac06763682d63aa8c21<\/td>\n TrickMo Dropper \u2014 com.app16330.core20461 (TikTokApp18+)<\/td>\n<\/tr>\n \n SHA-256<\/td>\n 177ef86c57c31b29850227dbc8288b735bea977587f2f0a49cfc4089a644a2c4<\/td>\n TrickMo Dropper \u2014 com.app15318.core1173 (TikTokApp18+)<\/td>\n<\/tr>\n \n SHA-256<\/td>\n e2e218ddf698b4c0099fd2a9619d6912a71f75beb51669a4e3ae4fc71f745d03<\/td>\n TrickMo Host Application \u2014 uncle.collop416.wifekin78 (Google Play Services)<\/td>\n<\/tr>\n \n SHA-256<\/td>\n 749bbcbc3e5d2d524344d52b6471dfa7b8d3ecdeb0b11ab82c843d497a056c8f<\/td>\n TrickMo Host Application \u2014 nibong.lida531.butler836 (Google Play Services)<\/td>\n<\/tr>\n \n SHA-256<\/td>\n 143c0e12d2aa1bdecde59f273139dd5605d00f61cda7f626224e07390119c026<\/td>\n Dex Module (old variant) \u2014 dex.module<\/td>\n<\/tr>\n \n SHA-256<\/td>\n 4cd8635062ff6b0885216a0b1658ebcb2938b670f7ac08ecb0b5fb85d8973ea0<\/td>\n Dex Module (new variant) \u2014 dex.module<\/td>\n<\/tr>\n \n Package Name<\/td>\n com.app16330.core20461<\/td>\n TrickMo Dropper disguised as TikTokApp18+<\/td>\n<\/tr>\n \n Package Name<\/td>\n com.app15318.core1173<\/td>\n TrickMo Dropper disguised as TikTokApp18+<\/td>\n<\/tr>\n \n Package Name<\/td>\n uncle.collop416.wifekin78<\/td>\n TrickMo Host Application disguised as Google Play Services<\/td>\n<\/tr>\n \n Package Name<\/td>\n nibong.lida531.butler836<\/td>\n TrickMo Host Application disguised as Google Play Services<\/td>\n<\/tr>\n \n Package Name<\/td>\n dex.module<\/td>\n Runtime-loaded offensive DEX module<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n [.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n