# TrickMo Banking Trojan Evolves to Use TON Blockchain C2 and Network Pivoting Capabilities


A new variant of the TrickMo Android banking trojan has emerged with significantly expanded capabilities, leveraging blockchain technology for command-and-control communications while turning compromised devices into network reconnaissance and traffic routing tools. Discovered by Dutch security firm ThreatFabric between January and February 2026, the latest iteration—labeled TrickMo C—targets banking and cryptocurrency users across Europe, with particular focus on France, Italy, and Austria.


The shift in TrickMo's architecture represents a troubling escalation: from a traditional banking credential-stealing malware to a sophisticated remote access tool capable of operating as a programmable network pivot, granting attackers foothold access into both home and corporate networks.


## The Threat: From Banking Trojan to Network Asset


TrickMo has evolved considerably since its initial discovery in late 2019. The original malware—first documented by CERT-Bund and IBM X-Force—specialized in abusing Android's accessibility services to intercept one-time passwords (OTPs) protecting banking credentials. Early variants could phish credentials, log keystrokes, record screens, facilitate live screen streaming, and intercept SMS messages.


The current TrickMo C variant retains these foundational capabilities but adds a dangerous new dimension: it transforms compromised Android devices into managed network assets.


Key features of the latest variant include:


  • SOCKS5 Proxy functionality — Routes traffic through the device, defeating IP-based fraud detection systems
  • SSH Tunneling — Creates encrypted tunnels for command execution
  • Network reconnaissance suite — Supports curl, dnslookup, ping, telnet, and traceroute commands
  • TON blockchain C2 — Uses decentralized infrastructure for stealthy command-and-control
  • Remote shell capabilities — Grants attackers shell-equivalent access from the victim's network position

    • According to ThreatFabric's analysis, this represents a fundamental shift in operational purpose: "Instead of functioning primarily as a traditional banking trojan, the malware now operates as a tool for establishing managed footholds within victim networks."


    ## Technical Details: Blockchain C2 and the TON Proxy Architecture


    The most significant technical innovation in TrickMo C is its integration of The Open Network (TON) blockchain for command-and-control communications. This approach offers attackers several operational advantages.


    ### How the TON C2 System Works


    The malware carries an embedded native TON proxy that the host APK initializes on a loopback port at process startup. All HTTP client requests from the bot are routed through this proxy, with command-and-control traffic addressed to .adnl hostnames. These addresses are resolved through the TON overlay network rather than conventional DNS infrastructure.


    Why this matters for attackers:


    | Traditional C2 | TON-Based C2 |

    |---|---|

    | Vulnerable to DNS sinkholing | Distributed resolution via blockchain |

    | Centralized server takedowns possible | Decentralized infrastructure resilience |

    | Network-level blocking effective | Traffic blends with legitimate TON activity |

    | ISP-level monitoring detectable | Difficult to distinguish from normal blockchain queries |


    The technical sophistication here is notable: by routing C2 through TON's overlay network, the malware effectively creates a command channel that bypasses conventional network security monitoring and traditional takedown mechanisms. As ThreatFabric noted, this makes the traffic "blend with legitimate TON activity," allowing it to evade standard network detection signatures.


    ### Runtime APK Loading and Modular Architecture


    TrickMo C employs a multi-stage infection process. The initial dropper app is distributed disguised as an adult-friendly version of TikTok via Facebook, then masquerades as Google Play Services on the victim's device. Once installed, the dropper retrieves a dynamically loaded APK—called "dex.module"—from attacker-controlled infrastructure at runtime.


    This modular approach provides operational flexibility: the core developers can update functionality, add new features, and modify capabilities without requiring users to reinstall the primary malware payload.


    ### Network Reconnaissance and Pivoting


    Where TrickMo C truly becomes a network threat is in its network-operative subsystem. The malware supports an arsenal of reconnaissance commands:


  • curl — Fetch web content and test connectivity
  • dnslookup — Enumerate DNS resolution
  • ping — Probe network hosts
  • telnet — Test service availability
  • traceroute — Map network topology

    • Combined with the SOCKS5 proxy functionality, this transforms the compromised device into what security researchers call a programmable network pivot: attackers gain the ability to conduct internal network reconnaissance from within the victim's network perimeter, probe internal services, and route malicious traffic through a device with legitimate network credentials and local trust relationships.


    ## Background and Context: The Evolution of TrickMo


    TrickMo first emerged in the wild in late 2019, initially identified for its ability to abuse Android accessibility services—a legitimate Android feature intended to assist users with disabilities—to hijack one-time passwords protecting banking accounts. Over subsequent variants, the malware expanded its capabilities to include full remote device control, SMS interception, and credential harvesting.


    Previous versions distributed "dex.module" with accessibility-driven remote control functionality channeled through socket.io connections. The new TrickMo C variant fundamentally restructures this approach: rather than focusing on direct device control for credential theft, it emphasizes network positioning and infrastructure access.


    This shift aligns with broader trends in malware evolution, where attackers increasingly view compromised mobile devices not as endpoints for credential harvesting, but as network assets enabling deeper infrastructure penetration.


    ## Distribution and Infection Vector


    TrickMo C is distributed through a sophisticated social engineering chain:


    1. Facebook advertisements promote adult-friendly versions of TikTok

    2. Users download the dropper application

    3. The dropper impersonates Google Play Services — one of Android's most trusted system applications

    4. At runtime, the dropper retrieves the actual TrickMo payload ("dex.module") from attacker infrastructure


    Observed package names for TrickMo variants include:

  • Droppers: com.app16330.core20461, com.app15318.core1173
  • Malware: uncle.collop416.wifekin78, nibong.lida531.butler836

    • The use of randomly generated, disposable package names is intentional—it complicates takedown efforts and allows threat actors to rapidly iterate on new variants.


    ## Implications: Who's Exposed and What's at Risk


    The geographic focus on France, Italy, and Austria suggests TrickMo C is targeting specific banking institutions or regional financial infrastructure. However, the technical capabilities indicate broader exposure potential.


    At-risk organizations and individuals:


  • Banking institutions — Potential for large-scale account compromise and fraud
  • Cryptocurrency exchanges — Wallets and trading platforms are explicit targets
  • Corporate networks — Companies whose employees use Android devices with corporate network access face potential internal reconnaissance and lateral movement
  • Home networks — Users with personal devices connected to home WiFi may inadvertently enable attackers to probe home network infrastructure
  • VPN and authentication services — The SOCKS5 proxy can route traffic to bypass IP-based fraud detection

    • A particular concern is the blending of personal and corporate device usage. Employees working remotely with personal Android devices could unknowingly grant attackers network access to corporate infrastructure.


    ## Dormant Features: A Preview of Future Capabilities


    ThreatFabric's analysis identified two notable dormant features not yet activated in the wild:


    1. Pine hooking framework — A sophisticated code injection system that could enable deeper system-level control

    2. Extensive NFC permissions — Near-field communication capabilities suggesting potential for physical device interaction or mobile payment interception


    The presence of these unimplemented features indicates the TrickMo development team is actively planning capability expansion, with these features likely to be activated in future variants.


    ## Recommendations: Detection and Mitigation


    For individuals:


  • Avoid sideloading applications; use only official app stores
  • Scrutinize Facebook advertisements for mobile applications
  • Enable Play Protect on Android devices
  • Review accessibility service permissions regularly—legitimate apps should rarely require these permissions
  • Keep Android security patches current

    • For organizations:


  • Implement mobile device management (MDM) solutions with real-time threat monitoring
  • Restrict or monitor SOCKS5 proxy capabilities on corporate networks
  • Conduct user awareness training specifically targeting mobile banking trojan vectors
  • Monitor outbound connections to TON network infrastructure—legitimate traffic is minimal for most organizations
  • Implement network segmentation to limit impact of compromised mobile devices

    • For financial institutions:


  • Implement additional verification for transactions from devices showing suspicious network activity
  • Monitor for access patterns inconsistent with legitimate user behavior
  • Consider requiring hardware-based authentication for sensitive operations
  • Coordinate with law enforcement and security vendors on TON-based C2 infrastructure takedowns

    • ---


    ## HackWire Analysis


    The evolution of TrickMo from banking credential-stealer to infrastructure reconnaissance platform signals a fundamental shift in Android malware strategy. Rather than viewing compromised phones as disposable tools for password harvesting, threat actors now recognize them as persistent, trusted network assets with legitimate access to sensitive environments.


    What makes TrickMo C particularly concerning is the architectural decision to leverage TON blockchain infrastructure for C2. This isn't merely a technical novelty—it represents a calculated response to traditional network defense mechanisms. Most organizations' security teams are trained to detect suspicious DNS queries, block known C2 servers, and perform ISP-level coordination against centralized command infrastructure. TON's decentralized architecture effectively neutralizes these defenses. The malware's C2 traffic doesn't look malicious; it looks like normal blockchain interaction.


    The timing also matters. We're in a period where cryptocurrency adoption is accelerating among retail users, and TON (backed by Telegram's ecosystem) is gaining real infrastructure legitimacy. This provides perfect cover for attacker-controlled C2 traffic—legitimate TON activity and malicious C2 become indistinguishable at the network level.


    For defenders, the critical takeaway is that SOCKS5 pivoting combined with network reconnaissance tools transforms a single compromised device into a beachhead for internal network attacks. A single infected employee's phone could grant attackers the visibility needed to map corporate network topology, identify high-value targets, and execute lateral movement—all from within trusted network perimeters where traditional perimeter-based defenses provide no protection.


    The dormant Pine hooking framework and NFC capabilities indicate this threat will intensify. Organizations should assume that future variants will attempt deeper system-level compromise. The question for defenders isn't whether to prepare for this escalation, but how quickly they can implement the visibility and controls necessary to detect and contain it.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Mobile Security](https://www.hackwire.news/category/mobile-security) and [Banking Threats](https://www.hackwire.news/category/banking-threats)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)