New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

Cybersecurity researchers have flagged a new version of the TrickMo Android banking trojan that uses The Open Network TON for commandandcontrol C2 The new variant observed by ThreatFabric between January and February 2026 has been observed actively targeting banking and cryptocurrency wallet users in France Italy and Austria TrickMo relies on a runtimeloaded APK dexmodule