New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots
According to a report shared with The Hacker News, cybersecurity researchers have discovered a new version of the TrickMo Android banking trojan that uses The Open Network (TON) for command-and-control (C2). The new variant, which was discovered by ThreatFabric between January and February 2026, is actively targeting banking and cryptocurrency wallet users in France, Italy, and Austria. TrickMo relies on a runtime-loaded APK (dex.module), which was also used by the previous variant.
Between January and February of 2026, ThreatFabric saw that the new edition was actively targeting customers of cryptocurrency wallets and banks in France, Italy, and Austria.
The Dutch mobile security firm stated in a report shared with The Hacker News that TrickMo is based on a runtime-loaded APK (dex....