TrickMo
MITRE ATT&CK: S0427 View on attack.mitre.org
Aliases: TrickMo
- Malware type
- trojan
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 95 (67 malicious)
- Last IoC activity
- 2026-10-07 04:13:12
- Profile updated
- 2026-07-07 14:10:08
Targeted industries: financial-services
Targeted regions: country_code:de
Context
TrickMo a 2FA bypass mobile banking trojan, most likely being distributed by TrickBot. TrickMo has been primarily targeting users located in Germany. TrickMo is designed to steal transaction authorization numbers (TANs), which are typically used as one-time passwords.
Recent IoC activity
67 malicious indicators in Maltiverse are attributed to TrickMo (S0427). The 20 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | mobiportal.at | 2026-10-07 | 1 |
| hostname | havebeprotredo.at | 2026-10-05 | 1 |
| hostname | shoesdiscountmee.info | 2026-10-05 | 1 |
| hostname | controlsync.at | 2026-10-02 | 1 |
| hostname | btceducationcenter.com | 2026-09-09 | 1 |
| hostname | traktortany.org | 2026-09-03 | 1 |
| hostname | heyclodere.at | 2026-09-03 | 1 |
| hostname | starnow.cn.com | 2026-09-03 | 1 |
| hostname | b-need-for-speed.online | 2026-09-03 | 1 |
| file sample | TrickMo.apk | 2026-09-03 | 2 |
| hostname | skyfrostweb.cn.com | 2026-09-03 | 1 |
| file sample | TikTok18.apk | 2026-08-13 | 2 |
| file sample | AdGuard.apk | 2026-05-27 | 1 |
| file sample | 6f58b07b5ddabc29c9c7e7165349edbd2bee923446514044d67040de2f36664a | 2026-03-14 | 1 |
| file sample | TikTok18plus.apk | 2026-03-14 | 1 |
| file sample | 02.ak | 2026-02-27 | 1 |
| URL | http://193.143.1.138/negxsh3dy1mdkqphuc | 2026-01-24 | 1 |
| file sample | 6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5 | 2026-01-15 | 1 |
| URL | http://havebeprotredo.at/243uwuyki | 2026-01-03 | 1 |
| URL | http://mobiportal.at/itezlthrf5m | 2025-12-31 | 1 |
Malware & tools used
- Broadcast Receivers (attack-pattern)
- Internet Connection Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Device Lockout (attack-pattern)
- Web Protocols (attack-pattern)
- Wi-Fi Discovery (attack-pattern)
- SMS Messages (attack-pattern)
- Software Discovery (attack-pattern)
- Uninstall Malicious Application (attack-pattern)
- Input Injection (attack-pattern)
- Out of Band Data (attack-pattern)
- System Information Discovery (attack-pattern)
- Screen Capture (attack-pattern)
- SMS Control (attack-pattern)
- Data from Local System (attack-pattern)
- System Checks (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
Reports & references
- medium.com — Analysis Of Malicious Mobile Applications Impersonating Popular Polish Apps Olx Allegro Iko 7Dab879A320D (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Trickmo (report)
- zimperium.com — Expanding The Investigation Deep Dive Into Latest Trickmo Samples (report)
- cyble.com — Trickmos Return Banking Trojan Resurgence With New Features (report)
- securityintelligence.com — Trickbot Pushing A 2Fa Bypass App To Bank Customers In Germany (report)
- cleafy.com — A New Trickmo Saga From Banking Trojan To Victims Data Leak (report)
- MITRE ATT&CK — S0427 (report)