New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

Cybersecurity researchers have discovered a new variant of the TrickMo Android banking trojan that uses The Open Network for command-and-control and targets users in France, Italy, and Austria. The new variant was observed between January and February 2026 and relies on a runtime-loaded APK. It actively targets banking and cryptocurrency wallet users.