TrickMo is mobile malware designed to steal banking credentials and one-time authentication codes from Android devices. It is commonly used to intercept login flows, overlay fake screens, and capture sensitive messages or notifications. Defenders should check for suspicious accessibility use, overlay abuse, and banking sessions from devices that show signs of compromise.
What TrickMo does and why it matters
TrickMo is a mobile banking trojan built to steal credentials and one-time codes from Android devices. It is dangerous because it targets the login flow itself, not just stored data, which means defenders must treat compromise as an active session-hijack problem.
Its most damaging behaviour is interception, it can place fake screens over legitimate apps, capture sensitive messages or notifications, and defeat some user-based trust signals by making a malicious prompt look routine.
How TrickMo typically operates on a compromised device
TrickMo commonly relies on abuse of Android capabilities that are legitimate in normal use but dangerous when granted to malware, especially accessibility services and overlay permissions. Those capabilities can let the malware observe user actions, display convincing overlays, and harvest credentials as the victim interacts with banking apps.
This family is best understood as a workflow interceptor. Rather than waiting for a database leak, it watches the moment secrets are entered, then uses the device itself as the collection point for banking credentials and authentication codes.
What exposure defenders should look for
Exposure is not limited to devices that have obviously suspicious apps installed. A compromised handset may still reach banking services, receive OTPs, and show normal-looking user activity while the malware quietly inserts itself into authentication and message handling.
Signals such as unusual accessibility usage, overlay behaviour, or banking sessions from a device that shows compromise indicators are especially important because they suggest the trust boundary has shifted from the app to the endpoint.
For broader context on mobile threat patterns, overlay abuse, accessibility abuse and Android banking trojans, see the Mobile Malware Guide.
How teams reduce impact and recover
Containment usually starts with removing the malware path, but recovery should also assume that the device may have exposed live banking sessions, credentials, and message-based one-time codes. Because the malware operates at the interaction layer, simple app removal may not be enough if the attacker already captured reusable access.
Defenders should validate the device state, review recent banking activity, and treat any suspicious session or authentication event as potentially tainted until proven otherwise. If access was used from a compromised phone, rotating credentials and re-establishing trustworthy authentication from a clean device is often part of the recovery picture.
Mobile credential theft aligns with the control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls, which ties authentication, logging, and system integrity together.
Risk and Threat Considerations
TrickMo is risky because it turns the victim device into an interception point for both authentication and banking activity. Once a trojan can observe overlays, accessibility events, and notifications, it can capture secrets at the moment they are used, which is often more valuable to attackers than stealing them later from storage.
Failure mechanism: The malware abuses trusted Android interaction paths to place fake screens, observe user input, and harvest one-time codes before the banking app can complete a normal authentication flow.
Impact: Attackers may gain direct access to banking sessions, bypass second-factor protections that rely on SMS or notifications, and perform fraudulent actions under the victim’s apparent identity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-10 — Malware Defenses | Mobile malware threats map directly to malware prevention and detection controls. |
| Recommendation — Strengthen malware defenses on Android endpoints and block suspicious app behaviour before it reaches banking apps. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | TrickMo steals one-time codes and credentials, making authenticator protection central. |
| SI-3 — Malicious Code Protection | The term concerns malware detection and containment on endpoints. | |
| AU-6 — Audit Review, Analysis, and Reporting | Investigating suspicious banking sessions and compromise indicators requires log review. | |
| Recommendation — Harden authenticator lifecycle controls and invalidate exposed secrets after suspected compromise. Deploy malicious code protection to detect and quarantine suspicious mobile payloads and behaviours. Review authentication and session logs for signs of device-mediated credential theft and misuse. | ||
| MITRE ATT&CK | T1518 — Software Discovery | Android malware often checks the device and environment before proceeding with abuse. |
| Recommendation — Map observed mobile malware behaviour to ATT&CK and hunt for pre-attack discovery on compromised devices. | ||