# TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users in France, Italy, and Austria

> ThreatFabric tracks a new TrickMo variant ('Trickmo.C') active since January 2026 that routes command-and-control through The Open Network (TON) using 256-bit .ADNL identities resolved by an embedded local TON proxy on the infected device, bypassing public DNS and domain-takedown defenses. Distributed via malicious APKs masquerading as TikTok and streaming applications, the trojan targets banking and cryptocurrency wallet users in France, Italy, and Austria, and adds first-class operator networking primitives (curl, dnsLookup, ping, telnet, traceroute, SSH tunneling, local/remote port forwarding, authenticated SOCKS5) on top of the malware family's existing on-device fraud capabilities.

- **Published:** 2026-05-11T12:00:00Z
- **Last reviewed:** 2026-05-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0494
- **ID:** TL-2026-0494
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TrickMo.C is the May-2026 evolution of the long-running TrickMo Android banking trojan, originally derived from the TrickBot ecosystem in 2019 and previously tracked by Cleafy, Cyble, and Zimperium through 2024-2025. ThreatFabric tracks the current campaign as 'Trickmo.C' and has observed active operations since January 2026, with installers distributed through SMS smishing, malicious overlay landing pages, and side-loaded APKs disguised as TikTok clones, premium streaming apps, and similar consumer-facing lures. Targeting telemetry concentrates in three Western European countries — France, Italy, and Austria — with overlay sets tailored to local retail banking, neobank, and cryptocurrency wallet apps.

The defining novelty of the 'C' variant is its abandonment of conventional HTTPS-over-DNS C2 in favor of The Open Network (TON) overlay routing. Each implant ships with an embedded local TON proxy that joins the TON peer-to-peer network on the infected device and resolves operator endpoints by their 256-bit Abstract Datagram Network Layer (ADNL) identities. Because ADNL addresses are public-key derived and resolved within the overlay, defenders cannot break the channel by seizing a domain or coercing a DNS provider; from the perspective of a network edge sensor the only observable traffic is encrypted TON peer traffic, indistinguishable in shape from any legitimate TON wallet, dApp, or storage client on the same device. This delivers a step-change in C2 resilience compared with prior TrickMo generations that relied on hardcoded fallback domains and CDN-fronted endpoints.

The trojan retains a two-stage modular architecture: a benign-looking host APK loader requests Android Accessibility Service privileges, then fetches a runtime offensive module that contains the bulk of fraud functionality. Capabilities inherited from prior TrickMo builds include HTML phishing overlays for banking and crypto login screens, full-screen lockscreen overlays, keystroke logging via Accessibility events, live screen streaming to the operator, screenshot capture, SMS and notification interception (including OTP suppression to defeat 2FA), clipboard sniffing and substitution (relevant to crypto address swapping), PIN and unlock-pattern theft, and contact-list and gallery exfiltration. New in 'Trickmo.C' is an operator-grade networking toolkit: an HTTP client (curl-equivalent), dnsLookup, ping, telnet, traceroute, SSH tunneling, both local and remote TCP port forwarding, and authenticated SOCKS5 proxy support. Combined with TON-routed C2, these capabilities turn each infected handset into a low-cost residential pivot point inside the victim's mobile network — useful for proxying further fraud, abusing trusted banking-app session state, or reaching internal services on a tethered or enterprise-managed device.

Two observable anti-analysis features warrant attention. First, the package declares extensive NFC permissions that are not exercised by any current code path; ThreatFabric assesses this as scaffolding for a future card-emulation or relay-fraud capability rather than an active feature. Second, the build ships a copy of the Pine runtime hooking framework that is present but currently inactive, signalling planned in-process API hooking for finer-grained Android Accessibility and banking-SDK manipulation. Defenders should treat these as forward-looking indicators rather than current TTPs.

There is no CVE associated with this threat — it is a malware-family campaign, not a vulnerability — and no CVSS score applies. Attribution remains 'Unknown' (financially motivated criminal operator(s)); ThreatFabric has not publicly linked Trickmo.C to a named TA, and earlier TrickMo waves have been operated by multiple unrelated actors leasing the codebase. Defenders should prioritize EDR on enrolled mobile devices, mobile threat defense (MTD) policies that flag sideloaded APKs and excessive Accessibility-Service grants, egress monitoring for TON ports (default 4443/UDP and TCP/UDP variations), and customer-side education on banking-overlay phishing in the affected regions.

## MITRE ATT&CK

- T1476 Deliver Malicious App via Other Means
- T1660 Phishing
- T1575 Native API
- T1541 Foreground Persistence
- T1624 Event Triggered Execution
- T1626 Abuse Elevation Control Mechanism
- T1418 Software Discovery
- T1628 Hide Artifacts
- T1629 Impair Defenses
- T1406 Obfuscated Files or Information
- T1417 Input Capture
- T1517 Access Notifications
- T1422 System Network Configuration Discovery
- T1513 Screen Capture
- T1414 Clipboard Data
- T1636 Protected User Data
- T1521 Encrypted Channel
- T1509 Non-Standard Port
- T1437 Application Layer Protocol
- T1090 Proxy
- T1646 Exfiltration Over C2 Channel
- T1582 SMS Control

## Sources

- [TrickMo Android banker adopts TON blockchain for covert comms](https://www.bleepingcomputer.com/news/security/trickmo-android-banker-adopts-ton-blockchain-for-covert-comms/)
- [A new TrickMo saga: from Banking Trojan to Victim's Data Leak (Cleafy Labs)](https://www.cleafy.com/cleafy-labs/a-new-trickmo-saga-from-banking-trojan-to-victims-data-leak)
- [TrickMo's Return: Banking Trojan Resurgence with New Features (Cyble)](https://cyble.com/blog/trickmos-return-banking-trojan-resurgence-with-new-features/)
- [TrickMo Android Trojan Exploits Accessibility Services for On-Device Banking Fraud (The Hacker News)](https://thehackernews.com/2024/09/trickmo-android-trojan-exploits.html)
- [Updated TrickMo Banking Trojan Has New Tricks Up Its Sleeves (Packetlabs)](https://www.packetlabs.net/posts/updated-trickmo-banking-trojan-has-new-tricks-up-its-sleeves)
- [TON Documentation: ADNL Abstract Datagram Network Layer](https://docs.ton.org/learn/networking/adnl)
- [MITRE ATT&CK Mobile: Software Discovery (T1418)](https://attack.mitre.org/techniques/T1418/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0494