TrickMo: recovered C2 indicators & analysis

What TrickMo is

TrickMo is an Android banking trojan first observed in the wild in September 2019 (initially flagged by CERT-Bund) and publicly documented by IBM X-Force in 2020. It is attributed to the operators of the TrickBot Windows banking malware, and its original purpose was to defeat mobile transaction authorization: it intercepted one-time passwords (OTPs) and other SMS/push-based two-factor authentication codes so the gang could authorize fraudulent transfers. The family has continued to evolve well beyond that original OTP-stealer role.

Modern TrickMo variants center on Android accessibility service abuse. Once the accessibility permission is granted, the malware auto-approves further permission prompts, automatically taps through dialogs, dismisses the keyguard, and can obstruct uninstallation. Core capabilities include HTML/WebView overlay attacks that mimic legitimate banking, cryptocurrency, and authenticator apps to phish credentials; keylogging; screen recording and live screen streaming; SMS interception and silent suppression of OTP notifications; broad data exfiltration (SMS, photos, and stored credentials); and remote device control amounting to device takeover. A distinctive later feature is a full-screen fake device-unlock screen (an HTML page) that captures the victim's PIN or unlock pattern and sends it, together with the Android ID, to attacker infrastructure.

In 2024 Cleafy and Zimperium published overlapping research on the family. Cleafy documented a variant delivered by a dropper disguised as Google Chrome that used anti-analysis techniques such as malformed ZIP archives and JSONPacker to conceal its DEX payload, and found a misconfigured command-and-control server exposing roughly 12 GB of exfiltrated victim data (credentials, images, and logs) without authentication. Zimperium's follow-on analysis identified around 40 TrickMo variants, 16 droppers, and 22 command-and-control servers, and estimated at least 13,000 victims, concentrated in Canada, the United Arab Emirates, Turkey, and Germany. C2 communication in these variants used HTTP POST requests carrying JSON payloads.

A 2026 variant reported by ThreatFabric shows further development: it is described as device-takeover malware whose command-and-control traffic was moved off the conventional internet onto The Open Network (TON), using .adnl endpoints routed through an embedded local TON proxy to resist DNS-based takedown. That variant also embeds a SOCKS5 proxy and SSH tunneling, letting an infected device act as a network exit node, and was observed in campaigns in France, Italy, and Austria.

Capabilities

• Accessibility service abuse (auto-grant permissions, auto-tap prompts, dismiss keyguard, hinder uninstall)
• OTP interception via SMS and push notifications, with silent suppression of OTP notifications
• HTML/WebView overlay attacks to phish banking, crypto, and authenticator credentials
• Keylogging
• Screen recording and live screen streaming
• Fake full-screen device-unlock screen that steals PIN and unlock pattern plus Android ID
• SMS interception and harvesting
• Data exfiltration (credentials, SMS, photos, device data)
• Remote device control / device takeover
• Delivered via dropper apps (e.g. masquerading as Google Chrome)
• Anti-analysis: malformed ZIP archives and JSONPacker payload concealment
• Network pivoting via embedded SOCKS5 proxy and SSH tunneling (later variant)

Known C2 / channel types: HTTP(S) REST (JSON over HTTP POST), TON (The Open Network) / ADNL endpoints via embedded local proxy (2026 variant).

MITRE ATT&CK (Mobile)

Techniques commonly associated with TrickMo:

What Privara Unmask recovered

C2 recovered from the executed sample. Benign co-observed hosts (an IP-echo service, an attribution SDK endpoint, and a GitHub badge CDN) were classified as noise and excluded. The analysis ran on a de-emulated Android 17 device that the sample could not fingerprint as virtual, so it behaved as it would on a real handset.

Indicators of compromise (IOCs)

External references

• Expanding the Investigation: Deep Dive into Latest TrickMo Samples
  Zimperium
• A new TrickMo saga: from Banking Trojan to Victim's Data Leak
  Cleafy Labs
• New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps
  ThreatFabric
• TrickMo malware steals Android PINs using fake lock screen
  BleepingComputer
• TrickMo Android Trojan Exploits Accessibility Services for On-Device Banking Fraud
  The Hacker News

Methodology & honest limits

This sample was obtained from MalwareBazaar and detonated in a controlled, isolated environment. C2 identity was recovered from the executing sample and its configuration. We report only what the analysis established: an offline sample yields a C2 identity, not a live beacon, and we say so. Nothing here is inferred beyond the evidence.