Security researchers say a newly discovered piece of malicious software designed to drain bank accounts has hit 13,000 people.
Experts at the cybersecurity firm Zimperium say a new variant of a trojan called TrickMo is infecting Android devices through phishing and social engineering attacks, often disguising itself as legitimate-looking banking and utility apps.
Zimperium, which is building on primary findings by the security firm Cleafy, says this new variant can obfuscate its code to evade detection and can also capture a device’s unlock pattern or pin, making it especially dangerous.
It can also intercept login credentials, one-time passwords, access photos and documents, automatically grant permissions, record screens and control nearby devices remotely.
Researchers say the trojan’s new abilities could open the door to identity theft and other attacks.
“The new findings underscore an enhancement in the Threat Actor’s capabilities.
Although TrickMo retains the typical functionalities of an Android banking Trojan, the data collected from infected devices could enable the attacker to undertake additional actions, compromising the victim on multiple levels.”
TrickMo is associated with the TrickBot group, a notorious Russia-linked criminal organization.
Researchers say they’ve identified over 13,000 victims’ IP addresses, revealing a wide reach of the new malware with primary targets in Canada, United Arab Emirates, Turkey and Germany.
Generated Image: Midjourney