BingoMod is a newly discovered and actively developed Android remote access trojan (RAT) that targets users through SMS phishing, posing as legitimate security tools like antivirus apps or Chrome updates. Attributed to a likely Romanian-speaking threat actor, BingoMod is capable of performing on-device fraud (ODF) by taking over accounts and initiating fraudulent money transfers of up to €15,000 per transaction directly from compromised devices. It requests permissions for Accessibility Services, allowing it to steal sensitive information such as login credentials and bank account details, intercept SMS messages, and take screenshots. The malware establishes a socket-based channel for remote commands and an HTTP-based channel for transmitting real-time screen content to the attackers. Notably, BingoMod employs advanced evasion techniques, including code obfuscation, the ability to uninstall security apps, and a self-destruction mechanism to wipe evidence. This self-destructive capability and real-time operator involvement distinguishes BingoMod from other Android banking trojans, highlighting a focus on simplicity and effective evasion. CTIX analysts will continue to report on novel malware and attack techniques.