TrickMo Android Trojan Leverages TON for C2 and SOCKS5 Pivots

A new variant of the TrickMo Android banking trojan has emerged, actively exploiting The Open Network (TON) for its command-and-control (C2) infrastructure. According to The Hacker News, citing observations by ThreatFabric between January and February 2026, this advanced version also utilizes SOCKS5 proxies to establish network pivots, enhancing its stealth and resilience.

This updated TrickMo variant is specifically targeting users of banking and cryptocurrency applications across France, Italy, and Austria. The Hacker News notes that the trojan’s operational sophistication is elevated by its reliance on a runtime-loaded APK module (dex.module), a technique that complicates detection and analysis. This approach allows the malware to dynamically load malicious components, adapting its attack surface post-infection.

The use of TON for C2 is a significant shift, providing attackers with a decentralized and encrypted communication channel that is inherently more resistant to traditional takedowns and surveillance. Coupled with SOCKS5 for network pivoting, this variant presents a formidable threat, enabling attackers to route traffic through compromised devices and evade direct attribution. It’s a clear move to harden infrastructure against law enforcement and security industry efforts.