TrickMo Android Malware Adds TON-Based C2 and Network Tunnelling
Summary
A new TrickMo variant targeting banking and wallet users in France, Italy, and Austria moves C2 to TON and adds SSH tunnelling and SOCKS5 proxying, turning infected Android devices into network pivots.
Key points
- Researchers tracked the variant in active campaigns from January to February 2026; telemetry suggests it is replacing the previous version.
- TrickMo routes its primary C2 through TON using an embedded local proxy, reducing reliance on conventional DNS and public internet infrastructure.
- Its runtime-loaded dex.module adds network reconnaissance commands, SSH port forwarding, and an authenticated SOCKS5 proxy.
- These capabilities can let operators probe networks accessible to an infected phone and route traffic through the victim’s device and IP address.
- The malware retains credential phishing, keylogging, screen capture, remote control, and interception of SMS and notifications, including one-time-password messages.
- Pine hooking code and NFC permissions are present but not actively used; researchers say these may support capabilities delivered later.
Article Details
- Attack Vectors
- TrickMo C is distributed as Android dropper and host applications, then downloads and dynamically loads a separate DEX module at runtime.
- The malware coerces users into granting accessibility-service permission, enabling interactive device control and automation.
- Credential phishing uses fullscreen WebView overlays imitating legitimate banking apps; the malware also captures keystrokes and screen activity.
- The malware intercepts SMS messages and notifications, including suppressing one-time-password messages.
- Command-and-control traffic is routed through an embedded local TON proxy to .adnl endpoints.
- Operator commands perform network reconnaissance and establish SSH forwarding tunnels and an authenticated SOCKS5 proxy, using infected devices as network pivots and traffic-exit nodes.
- Defensive Notes
- Monitor Android devices for TrickMo dropper and host application artifacts, unexpected accessibility-service use, and runtime-loaded DEX modules.
- Investigate unexpected TON traffic and embedded local TON proxy activity in the context of suspected TrickMo infections.
- Look for suspicious SSH forwarding and SOCKS5 proxy activity originating from mobile devices, as well as network probes initiated from device vantage points.
- Review suspicious apps for SMS and notification interception, screen recording, keylogging, and accessibility-driven remote control.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 01889a9ec2abecb73e5e8792be68a4e3bc7dcbe1c3f19ac06763682d63aa8c21 | SHA-256 of a Trickmo dropper. |
| SHA256 | 143c0e12d2aa1bdecde59f273139dd5605d00f61cda7f626224e07390119c026 | SHA-256 of a DEX module associated with an older Trickmo variant. |
| SHA256 | 177ef86c57c31b29850227dbc8288b735bea977587f2f0a49cfc4089a644a2c4 | SHA-256 of a Trickmo dropper. |
| SHA256 | 4cd8635062ff6b0885216a0b1658ebcb2938b670f7ac08ecb0b5fb85d8973ea0 | SHA-256 of a DEX module associated with a newer Trickmo variant. |
| SHA256 | 749bbcbc3e5d2d524344d52b6471dfa7b8d3ecdeb0b11ab82c843d497a056c8f | SHA-256 of a Trickmo host application. |
| SHA256 | e2e218ddf698b4c0099fd2a9619d6912a71f75beb51669a4e3ae4fc71f745d03 | SHA-256 of a Trickmo host application. |
MITRE ATT&CK
T1046 · Network Service DiscoveryOperator commands perform network probes, including DNS lookups, ping, TCP connection checks, and traceroutes from the infected device.T1090 · ProxyAn authenticated SOCKS5 proxy on the infected device provides routed network egress; the article also describes exposing it through an SSH remote-forward tunnel.T1105 · Ingress Tool TransferThe malware retrieves its offensive DEX module from operator infrastructure.T1412TrickMo intercepts SMS messages, including one-time-password messages.T1417.001TrickMo records typed text and field metadata through keylogging.T1513The malware captures screenshots and streams screen frames.T1572 · Protocol TunnelingThe malware establishes SSH local- and remote-forward tunnels from the infected device.T1620 · Reflective Code LoadingTrickMo downloads and dynamically loads a DEX module at runtime.
Malware
Products
AndroidModern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities.The Open Network (TON)The most visible change is at the network layer, where the bot's command-and-control traffic has been moved off the conventional internet entirely and onto The Open Network (TON).
Tools
Countries
AustriaWe identified a new TrickMo variant, active in campaigns targeting banking and wallet users in France, Italy, and Austria.FranceWe identified a new TrickMo variant, active in campaigns targeting banking and wallet users in France, Italy, and Austria.ItalyWe identified a new TrickMo variant, active in campaigns targeting banking and wallet users in France, Italy, and Austria.
Industries
BankingModern Android banking malware increasingly evolves through architectural redesigns intended to improve stealth, resilience, and operational flexibility rather than through entirely new user-facing capabilities.fintechTrickMo is Device Take Over (DTO) malware targeting banking, fintech, wallet and authenticator applications on Android.