A new report from ThreatFabric says a TrickMo Android banking malware variant is using The Open Network, better known as TON, to make command-and-control traffic harder to trace, block, and disrupt.
The variant, tracked by the researchers as Trickmo.C, was described on May 11, 2026, and is said to be active in campaigns aimed at banking and cryptocurrency wallet users in France, Italy, and Austria. ThreatFabric says it began observing this version between January and February 2026; that timing has not been independently verified here.
TrickMo is not being presented as a brand-new malware family. The more important point is architectural: according to the research, the operators have reworked how the malware communicates and how compromised phones can be used after infection. For banks, exchanges, fraud teams, and mobile security buyers, that matters because the infected handset may not only be a credential-theft endpoint. It may also become a network pivot that makes malicious traffic appear to originate from the victim’s own device and IP address.
What changed in TrickMo.C
ThreatFabric describes TrickMo.C as a redesign of the existing TrickMo platform rather than a wholesale rewrite of its visible fraud features. The malware still fits the Android banking trojan pattern: it relies on social engineering, app impersonation, accessibility abuse, overlays, screen monitoring, and remote interaction to help operators steal credentials or move through financial workflows.
The reported distribution themes include apps disguised as TikTok or streaming services. ThreatFabric attributes some campaign tags to France, Italy, and Austria, but those campaign labels should be treated as vendor telemetry rather than a complete public map of all targeting.
The most notable change is the communications layer. Instead of depending only on ordinary internet-facing infrastructure, the malware is reported to route command traffic through TON .adnl endpoints by using an embedded local TON proxy on the infected device.
ThreatFabric says TON’s overlay routing makes conventional disruption harder because the operator endpoint is not exposed as a normal domain in the public DNS system. In practical terms, defenders who rely heavily on domain takedowns, DNS filtering, or simple IP blocking may have less to work with when traffic is wrapped inside a legitimate encrypted overlay network.
TON itself is a legitimate decentralized network associated historically with the Telegram ecosystem and used for lawful purposes. The issue in this case is the alleged abuse of TON transport by malware operators, not the mere existence of TON traffic on a device.
Why TON-based command traffic is harder to handle
For defenders, the shift is less about blockchain branding and more about visibility. A conventional malware command server may leave behind domains, IP addresses, hosting providers, certificates, and registrar data that can be investigated or disrupted. ThreatFabric says TrickMo.C instead uses .adnl addressing inside the TON overlay, which reduces the usefulness of traditional DNS-focused takedowns.
That does not make the malware invisible. Endpoint telemetry, mobile threat defense logs, app behavior, suspicious accessibility permission use, unexpected proxy activity, and abnormal screen-capture behavior still matter. But it can make network-only detection weaker, especially if the organization treats encrypted overlay traffic as a generic category without device context.
This is a familiar pattern in modern mobile fraud. Attackers increasingly try to blend command traffic into services or protocols that are harder to block broadly without business or user impact. The result is a detection problem that shifts away from single indicators and toward behavior: what app requested accessibility access, what process is opening local proxies, what permissions were granted, and whether the device is suddenly being used as a tunnel.
Firewalla Purple SE network security appliance
A network security appliance can help home and small-business users spot unusual outbound connections and device behavior that basic router logs may miss. It should complement, not replace, mobile endpoint controls.
As an Amazon Associate I earn from qualifying purchases.
Capabilities reported in the new variant
ThreatFabric says TrickMo uses a modular, two-stage structure. In that model, a host APK acts as the loader and persistence component, while a runtime-loaded APK module delivers the main offensive functionality. This design lets operators alter behavior without exposing every capability directly in the first installed app.
The report attributes the following familiar banking trojan capabilities to TrickMo:
- Credential phishing through full-screen overlays that imitate legitimate banking apps.
- Keylogging tied to foreground apps and typed fields.
- Screen recording and live screen streaming.
- Remote interaction through Android accessibility services.
- SMS and notification interception, including suppression of one-time password notifications.
- Clipboard modification, screenshot capture, and notification filtering.
The newer network-focused functions are the more commercially important part of the report. ThreatFabric says TrickMo.C adds commands and features that can probe networks and route traffic from the infected handset’s position.
- curl: HTTP probing with configurable request details.
- dnsLookup: DNS lookups from the device’s network view.
- ping: ICMP reachability checks.
- telnet: TCP connection testing across ports.
- traceroute: route tracing from the device.
- SSH tunneling: local and remote port forwarding.
- SOCKS5 proxying: an authenticated proxy running on the infected device.
Those claims come from ThreatFabric’s reverse engineering and telemetry and have not been independently reproduced here. If accurate, they move TrickMo further into network pivot territory. A compromised phone connected to a home Wi-Fi network, office network, or trusted mobile environment could be used as a traffic exit point, making fraudulent requests look more like they came from the victim’s own context.
That detail is especially relevant for fraud prevention teams that rely on IP reputation, geolocation, device consistency, or network history. If the infected phone itself becomes the proxy, an attack may carry fewer obvious location mismatches than a login attempt from a commodity hosting provider.
Dormant features deserve attention
The report also notes several components that appear to be present but inactive. ThreatFabric says the Pine runtime hooking framework is bundled and initialized, although the researchers did not find active hook installations in the analyzed code. Pine had previously been associated with intercepting networking and Firebase-related behavior in earlier malware activity.
ThreatFabric also says the app declares broad NFC-related permissions and reports NFC capability information in telemetry, but the researchers did not identify reachable NFC functionality in the stages they analyzed. That does not prove future NFC fraud is coming, but it does suggest operators may be collecting device capability information or preparing optional runtime-delivered modules.
For security teams, dormant functionality should not be dismissed just because it is inactive in one sample. Modular Android malware can keep code paths, permissions, and telemetry hooks ready for later use. The buying question is whether the organization’s mobile controls can detect risky permission patterns and staged payload behavior before a new module becomes active.
What Android users and security teams should do
The basic user advice remains practical, even if it is not a complete enterprise control strategy. Android users should avoid sideloading APKs from messages, ads, fake streaming offers, or unofficial download pages. They should install apps from Google Play when possible, keep Play Protect enabled, remove apps they do not recognize, and be cautious when any app asks for accessibility permissions without a clear and necessary reason.
For organizations, the stronger response is layered:
- Monitor managed Android devices for unusual accessibility-service grants.
- Flag newly installed apps that impersonate media, social, or utility brands but request sensitive permissions.
- Watch for local proxy behavior, SSH tunneling, screen capture, and remote-control patterns on mobile endpoints.
- Do not rely on DNS blocking alone for mobile malware detection.
- Review fraud rules that over-trust familiar IP addresses or previously seen device networks.
- Educate users that fake TikTok, streaming, banking-support, and update apps remain common delivery lures.
Malwarebytes Mobile Security for Android
An Android security app can add another layer for spotting suspicious apps, unsafe downloads, and mobile malware indicators. It is most useful when paired with safe app-install habits and careful permission review.
As an Amazon Associate I earn from qualifying purchases.
TrickMo.C is a useful reminder that mobile banking malware is no longer only about stealing an SMS code or showing a fake login page. The more serious trend is operational flexibility: malware that can hide command traffic, load functionality at runtime, and turn the victim’s own phone into infrastructure for fraud.
That is the part buyers should focus on. Controls that only look for known bad domains or known APK hashes will age quickly. The more durable signal is behavior on the device: sensitive permissions, overlay abuse, screen capture, proxying, tunneling, and command patterns that do not belong in a consumer app.
Yubico YubiKey 5 NFC security key
A hardware security key can reduce the damage from stolen passwords by requiring a physical factor for supported accounts. It does not clean an infected phone, but it can harden banking, email, crypto, and admin logins.
As an Amazon Associate I earn from qualifying purchases.