TrickMo Banking Trojan Resurgence: New Features

This report analyzes the TrickMo Android banking trojan, tracing its emergence in 2019 and a resurgence in 2023 with new capabilities: JsonPacker-based obfuscation, overlay HTML injection to capture credentials, expanded command set (45+ commands), Accessibility-service abuse for auto-clicking and log collection, module download capability, and exfiltration to a tracked C2 (http://keepass.ltd, 194.169.175.138). It enumerates targeted banking, crypto, and messaging apps, provides sample hashes and IOCs, and maps observed behaviors to MITRE ATT&CK techniques while offering defensive recommendations.