Expanding the Investigation: Deep Dive into Latest TrickMo Samples

Zimperium analyzed a new TrickMo banking-trojan variant that employs sophisticated evasion and credential-theft techniques—OTP interception, screen recording, overlay attacks, accessibility-service abuse, and a novel WebView-based UI that captures device PIN/patterns and Android ID. The report identifies 40 variants (16 droppers, 22 active C2s), exposed C2 data containing ~13,000 unique victim IPs and millions of records across multiple countries, maps MITRE ATT&CK techniques, and provides IOCs and mitigation recommendations.