New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

ThreatFabric observed a new TrickMo Android banking trojan variant (Jan–Feb 2026) targeting banking and cryptocurrency users in France, Italy, and Austria; the variant uses a runtime-loaded dex.module and an embedded local TON proxy for C2, and adds SSH tunnelling, SOCKS5 proxying, and network reconnaissance commands that turn infected devices into programmable network pivots. Distribution is via dropper apps impersonating TikTok and fake Google Play Services, with sample package names provided.