TrickMo Android Malware Targets Banking, Wallet, and Authenticator Apps

TrickMo, the Android banking malware, has resurfaced with a significantly redesigned architecture, targeting banking, fintech, wallet, and authenticator applications while introducing advanced stealth and network capabilities.

Rather than introducing entirely new user-facing functionality, the latest TrickMo variant focuses on backend improvements. The malware retains its core device takeover (DTO) capabilities but enhances stealth, persistence, and operational flexibility.

Once installed, TrickMo aggressively coerces users into granting accessibility permissions. This enables attackers to gain full remote control of infected devices, including real-time screen viewing and interaction.

The most notable evolution in this variant is its command-and-control (C2) communication. TrickMo has migrated away from traditional internet infrastructure and now operates over The Open Network (TON), a decentralized peer-to-peer network.

Security researchers in Threat Fabric observed this new variant, tracked between January and February 2026, actively deployed in campaigns across France, Italy, and Austria, indicating a gradual replacement of earlier TrickMo versions.

For example, when a victim opens a legitimate banking app, TrickMo can display a fake login overlay that captures credentials while silently recording user activity in the background.

Instead of using standard domains or IP addresses, the malware communicates through .adnl endpoints resolved داخل the TON network.

Additionally, when limited access to the regular internet is required, TrickMo uses DNS-over-HTTPS (DoH), ensuring that even DNS queries remain encrypted and hidden from local monitoring systems.

This shift significantly reduces the effectiveness of traditional takedown strategies and allows malicious traffic to blend with legitimate TON usage.

TrickMo Android Malware

The Android malware continues to leverage a modular design. The primary application acts as a loader and persistence mechanism, while its core malicious functionality is delivered through a dynamically loaded APK module named “dex.module.”

The malware continues to rely on proven techniques such as overlay-based credential phishing, keylogging, screen recording, and interception of SMS and push-based one-time passwords.

This module enables real-time remote control through a low-latency communication channel and can be selectively delivered based on geographic targeting.

Evidence suggests this modular approach has been in use since at least late 2024, but has now been expanded with new capabilities.

An embedded local TON proxy routes all traffic, making it difficult for defenders to detect or block communications using conventional DNS-based controls.

A major enhancement in this version is the introduction of network reconnaissance and tunneling features. Infected devices can now execute commands such as HTTP probing, DNS lookups, ping, and traceroute, effectively giving attackers visibility into the victim’s local network environment.

More critically, TrickMo can establish SSH tunnels and run an authenticated SOCKS5 proxy on the compromised device. This allows attackers to route traffic through the victim’s device, making malicious activity appear as if it originates from the user’s own network.

In practice, this can help bypass fraud detection systems used by banks, cryptocurrency platforms, and e-commerce services, as connections appear legitimate.

The bot’s HTTP client is wired through that proxy, so every outbound command-and-control request is addressed to an .adnl hostname and resolved through the TON overlay.

Researchers also identified unused but pre-configured features within the malware. The Pine hooking framework is present but inactive, and the app declares NFC-related permissions without implementing any NFC functionality.

These dormant components suggest that attackers are preparing to deploy additional capabilities dynamically in future campaigns without modifying the core application.

The latest TrickMo variant represents a strategic evolution rather than a complete reinvention. By leveraging decentralized infrastructure, modular payload delivery, and advanced tunneling capabilities, the malware becomes harder to detect, disrupt, and analyze.

This shift highlights a broader trend in mobile threats, where attackers prioritize architectural resilience and stealth to maintain long-term access and expand operational reach within increasingly secure environments.

Indicators of Compromise

SHA-256	Package name	Application name	Role
01889a9ec2abecb73e5e8792be68a4e3bc7dcbe1c3f19ac06763682d63aa8c21	com.app16330.core20461	TikTokApp18+	Trickmo Dropper
177ef86c57c31b29850227dbc8288b735bea977587f2f0a49cfc4089a644a2c4	com.app15318.core1173	TikTokApp18+	Trickmo Dropper
e2e218ddf698b4c0099fd2a9619d6912a71f75beb51669a4e3ae4fc71f745d03	uncle.collop416.wifekin78	Google Play Services	Trickmo Host application
749bbcbc3e5d2d524344d52b6471dfa7b8d3ecdeb0b11ab82c843d497a056c8f	nibong.lida531.butler836	Google Play Services	Trickmo Host application
143c0e12d2aa1bdecde59f273139dd5605d00f61cda7f626224e07390119c026	dex.module	–	Dex Module (old variant)
4cd8635062ff6b0885216a0b1658ebcb2938b670f7ac08ecb0b5fb85d8973ea0	dex.module	–	Dex Module (new variant)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.