TrickMo’s Stealthy Upgrade: Android Banking Malware is Pivoting to The Open Network

**Executive summary:** A new TrickMo Android banking trojan variant (Variant C) has been identified that replaces traditional internet-based C2 with The Open Network (TON) overlay via an embedded local TON proxy, evading DNS takedowns and network-edge detection; it ships a dynamically loaded module enabling network reconnaissance (curl, ping, dnslookup, traceroute), SSH tunneling/port forwarding, and an authenticated SOCKS5 proxy to route attacker traffic through infected devices, and is actively distributed in social‑engineering campaigns targeting banking and wallet users in France, Italy, and Austria.