CyberSIXT Search
Research reports

ThreatFabricPublished

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

Excerpt

Modern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities. As platform protections and detection measures continue to improve, operators adapt by redesigning communication layers, modularising offensive functionality, and strengthening persistence and remote-control mechanisms.

Between January and February 2026 our Mobile Threat Intelligence Team identified and began tracking a new variant of the TrickMo Android banking-trojan family in active distribution.

The variant is a direct e…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ThreatFabric on threatfabric.com.

Mentioned in the excerpt

More from ThreatFabric1

On the same topics

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device