TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users in France, Italy, and Austria
TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL (TL-2026-0494), also tracked as Trickmo.C, is a high-severity malware campaign, first published 2026-05-11. It has no confirmed attribution, affects Google Android, maps to 22 MITRE ATT&CK techniques (T1090, T1406, T1414), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0494
- Threat ID
- TL-2026-0494
- Also known as
- Trickmo.C, TrickMo C variant, TrickMo TON variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-11
- Last reviewed
- 2026-05-11
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- banking, financial, cryptocurrency, consumer-mobile, retail-banking, fintech
- Target regions
- France, Italy, Austria, Western Europe
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
Malware and tooling: TrickMo - S0427, Trickmo.C, Pine (Android runtime hooking framework), TON ADNL overlay routing
ThreatFabric tracks a new TrickMo variant ('Trickmo.C') active since January 2026 that routes command-and-control through The Open Network (TON) using 256-bit .ADNL identities resolved by an embedded local TON proxy on the infected device, bypassing public DNS and domain-takedown defenses. Distributed via malicious APKs masquerading as TikTok and streaming applications, the trojan targets banking and cryptocurrency wallet users in France, Italy, and Austria, and adds first-class operator networking primitives (curl, dnsLookup, ping, telnet, traceroute, SSH tunneling, local/remote port forwarding, authenticated SOCKS5) on top of the malware family's existing on-device fraud capabilities.
How TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL works
TrickMo.C is the May-2026 evolution of the long-running TrickMo Android banking trojan, originally derived from the TrickBot ecosystem in 2019 and previously tracked by Cleafy, Cyble, and Zimperium through 2024-2025. ThreatFabric tracks the current campaign as 'Trickmo.C' and has observed active operations since January 2026, with installers distributed through SMS smishing, malicious overlay landing pages, and side-loaded APKs disguised as TikTok clones, premium streaming apps, and similar consumer-facing lures. Targeting telemetry concentrates in three Western European countries — France, Italy, and Austria — with overlay sets tailored to local retail banking, neobank, and cryptocurrency wallet apps.
The defining novelty of the 'C' variant is its abandonment of conventional HTTPS-over-DNS C2 in favor of The Open Network (TON) overlay routing. Each implant ships with an embedded local TON proxy that joins the TON peer-to-peer network on the infected device and resolves operator endpoints by their 256-bit Abstract Datagram Network Layer (ADNL) identities. Because ADNL addresses are public-key derived and resolved within the overlay, defenders cannot break the channel by seizing a domain or coercing a DNS provider; from the perspective of a network edge sensor the only observable traffic is encrypted TON peer traffic, indistinguishable in shape from any legitimate TON wallet, dApp, or storage client on the same device. This delivers a step-change in C2 resilience compared with prior TrickMo generations that relied on hardcoded fallback domains and CDN-fronted endpoints.
The trojan retains a two-stage modular architecture: a benign-looking host APK loader requests Android Accessibility Service privileges, then fetches a runtime offensive module that contains the bulk of fraud functionality. Capabilities inherited from prior TrickMo builds include HTML phishing overlays for banking and crypto login screens, full-screen lockscreen overlays, keystroke logging via Accessibility events, live screen streaming to the operator, screenshot capture, SMS and notification interception (including OTP suppression to defeat 2FA), clipboard sniffing and substitution (relevant to crypto address swapping), PIN and unlock-pattern theft, and contact-list and gallery exfiltration. New in 'Trickmo.C' is an operator-grade networking toolkit: an HTTP client (curl-equivalent), dnsLookup, ping, telnet, traceroute, SSH tunneling, both local and remote TCP port forwarding, and authenticated SOCKS5 proxy support. Combined with TON-routed C2, these capabilities turn each infected handset into a low-cost residential pivot point inside the victim's mobile network — useful for proxying further fraud, abusing trusted banking-app session state, or reaching internal services on a tethered or enterprise-managed device.
Two observable anti-analysis features warrant attention. First, the package declares extensive NFC permissions that are not exercised by any current code path; ThreatFabric assesses this as scaffolding for a future card-emulation or relay-fraud capability rather than an active feature. Second, the build ships a copy of the Pine runtime hooking framework that is present but currently inactive, signalling planned in-process API hooking for finer-grained Android Accessibility and banking-SDK manipulation. Defenders should treat these as forward-looking indicators rather than current TTPs.
There is no CVE associated with this threat — it is a malware-family campaign, not a vulnerability — and no CVSS score applies. Attribution remains 'Unknown' (financially motivated criminal operator(s)); ThreatFabric has not publicly linked Trickmo.C to a named TA, and earlier TrickMo waves have been operated by multiple unrelated actors leasing the codebase. Defenders should prioritize EDR on enrolled mobile devices, mobile threat defense (MTD) policies that flag sideloaded APKs and excessive Accessibility-Service grants, egress monitoring for TON ports (default 4443/UDP and TCP/UDP variations), and customer-side education on banking-overlay phishing in the affected regions.
MITRE ATT&CK techniques used in TL-2026-0494
command-and-control
Defense Evasion
T1406 Obfuscated Files or Information; T1628 Hide Artifacts; T1629 Impair Defenses
Collection
T1414 Clipboard Data; T1513 Screen Capture; T1636 Protected User Data
Credential Access
T1417 Input Capture; T1517 Access Notifications
discovery
Discovery
T1422 System Network Configuration Discovery
Command and Control
T1437 Application Layer Protocol; T1509 Non-Standard Port; T1521 Encrypted Channel
Initial Access
T1476 Deliver Malicious App via Other Means; T1660 Phishing
Persistence
T1541 Foreground Persistence; T1624 Event Triggered Execution
Execution
Impact
Privilege Escalation
T1626 Abuse Elevation Control Mechanism
Exfiltration
Affected products and versions in TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
- Google — Android
Vulnerable versions: 8.0; 9; 10; 11; 12; 13; 14; 15 - Various — Mobile banking apps (FR/IT/AT institutions)
Vulnerable versions: all current versions on infected devices - Various — Cryptocurrency wallet apps
Vulnerable versions: all current versions on infected devices
Remediation for TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
Immediate actions
- Block sideloading of APKs from unknown sources on all managed Android devices via MDM policy (Settings > Apps > Special access > Install unknown apps = denied).
- Audit Android Accessibility Service grants on all enrolled devices and revoke for any non-business app; alert on net-new Accessibility grants.
- Egress-monitor for TON peer traffic from corporate-enrolled Android handsets and BYOD devices on the corporate Wi-Fi (well-known TON ports including UDP/4443 and dynamic UDP/TCP TON peer ranges).
- Push customer communications in FR/IT/AT markets warning against installing TikTok or streaming apps from outside Google Play or vendor app stores.
- Trigger forced re-authentication and step-up on banking/crypto sessions originating from Android user-agents in the targeted geographies.
Workarounds
- Disable 'Install unknown apps' for all browsers, file managers, and messaging apps as a per-app Special-Access setting.
- Quarantine devices where the package signer of TikTok or a streaming app does not match the official Google Play publisher fingerprint.
- Where business does not require it, block outbound UDP from BYOD/Corporate Wi-Fi to non-allowlisted destinations to disrupt TON peer joining.
Longer-term hardening
- Deploy a Mobile Threat Defense (MTD) agent capable of static APK analysis and runtime Accessibility-abuse detection.
- Implement Google Play Protect enforcement and Play Integrity API checks in banking and crypto-wallet apps to refuse to run on devices with sideloaded high-risk packages.
- Adopt FIDO2/passkey-based authentication and channel-bound transaction signing so that SMS/OTP interception alone cannot complete a fraudulent payment.
- Add SOCKS5/SSH-tunnel beacon behavioural detections to mobile EDR, since the new networking toolkit makes infected handsets viable residential proxies.
- Engage with TON Foundation abuse channels and peer with takedown counsel on overlay-network abuse — note that classical domain takedown will not work.
Weaknesses (CWE) in TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
CWE-829, CWE-94, CWE-250, CWE-285, CWE-359
Timeline of TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
- Original TrickMo Android banker first observed by IBM X-Force, derived from the TrickBot ecosystem to intercept Android-side mTAN/OTP messages.
- Cleafy and Cyble report a TrickMo resurgence with HTML overlays and aggressive Android Accessibility Service abuse for on-device banking fraud.
- Zimperium and Cleafy document TrickMo capability to capture PINs and unlock patterns via fake lockscreen overlays.
- ThreatFabric observes the first 'Trickmo.C' samples in the wild using embedded TON proxy for C2; January 2026 marks the start of active campaign tracking.
- Overlay sets tailored to French, Italian, and Austrian retail-banking and cryptocurrency-wallet apps observed in collected samples.
- Samples introduce curl, dnsLookup, ping, telnet, traceroute, SSH tunneling, local/remote port forwarding, and authenticated SOCKS5 — turning each handset into a viable residential pivot.
- Pine runtime hooking framework and unused NFC permissions observed in builds, assessed as forward-looking scaffolding for future card-emulation and in-process hooking.
- BleepingComputer publishes ThreatFabric's findings on Trickmo.C and its TON ADNL-based C2 mechanism; Threadlinqs Intelligence (TL-2026-0494) tracks the campaign.
- As of 2026-05-29, TrickMo.C is an active, ongoing Android banking-trojan campaign (ThreatFabric, disclosed May 11) progressively replacing older TrickMo builds and targeting FR/IT/AT users. Its TON ADNL-based C2 is takedown-resistant by design, with no reported disruption, sinkhole, arrest, or successor.
Sources cited for TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
- TrickMo Android banker adopts TON blockchain for covert comms
- A new TrickMo saga: from Banking Trojan to Victim's Data Leak (Cleafy Labs)
- TrickMo's Return: Banking Trojan Resurgence with New Features (Cyble)
- TrickMo Android Trojan Exploits Accessibility Services for On-Device Banking Fraud (The Hacker News)
- Updated TrickMo Banking Trojan Has New Tricks Up Its Sleeves (Packetlabs)
- TON Documentation: ADNL Abstract Datagram Network Layer
- MITRE ATT&CK Mobile: Software Discovery (T1418)
Threats related to TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services Abuse
- Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play
- Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking and Crypto Apps
- Albiriox Android Banking RAT-as-a-Service and the Barcode Scanner Play Store Supply-Chain Compromise: Sideloading, SMS Phishing, and Trojanized Updates as Android Distribution Vectors
- Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges
- Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands
Detection coverage for TL-2026-0494
As of 2026-05-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0494 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.