SOCKS5 proxy<\/a> functionality. This allows compromised Android devices to function as network pivots. Attackers can route malicious traffic through an infected phone, effectively hiding their true location while maintaining control over the botnet.<\/p>\nExploiting Accessibility Services<\/h2>\n
The malware continues to rely on Android\u2019s accessibility services, a common technique among banking trojans. Once granted these permissions, TrickMo can intercept two factor authentication codes, capture on screen text, and even perform automated clicks to complete fraudulent transactions.<\/p>\n
Researchers noted that the attackers are using social engineering tactics to trick victims into installing the malicious application. These lures often involve fake updates for popular applications or promises of financial rewards.<\/p>\n
The geographic focus on France, Italy, and Austria suggests a targeted campaign, though security experts warn that similar attacks could expand to other regions quickly. The modular nature of the malware allows operators to swap out target applications or C2 infrastructure with relative ease.<\/p>\n
Implications for Android Security<\/h2>\n
The adoption of TON and SOCKS5 proxies marks a shift toward more resilient and harder to trace command infrastructures. Traditional takedown methods that rely on seizing centralized servers may prove less effective against this approach.<\/p>\n
Security professionals recommend that Android users only install applications from the Google Play Store, carefully review requested permissions, and avoid granting accessibility access to any application that does not require it for legitimate use.<\/p>\n
Recommended Mitigations<\/h2>\n
For organizations, implementing mobile threat defense solutions can help detect the presence of runtime loaded payloads. Network monitoring should also look for unusual traffic patterns, especially SOCKS5 proxy usage on mobile devices.<\/p>\n
Users in the affected regions should be particularly cautious about unsolicited messages urging them to install or update financial applications. Banks and cryptocurrency services in France, Italy, and Austria have likely been alerted to the threat.<\/p>\n
The development of this variant underscores the ongoing arms race between cybercriminals and security researchers. As detection methods improve, attackers continue to adopt more sophisticated technologies to maintain their operations.<\/p>\n
Going forward, ThreatFabric expects the operators behind TrickMo to continue refining their techniques. The use of decentralized networks like TON may become a more common feature in mobile malware toolkits, potentially complicating future takedown efforts.<\/p>\n
Source: ThreatFabric<\/p>\n","protected":false},"excerpt":{"rendered":"
Cybersecurity researchers have identified a new variant of the TrickMo Android banking trojan that leverages The Open Network (TON) for command-and-control (C2) communications. The malware also utilizes SOCKS5 proxies to create network pivots within infected Android devices. ThreatFabric, the security firm tracking the threat, observed the new variant between January and February 2026. The campaign […]<\/p>\n","protected":false},"author":1,"featured_media":7118,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[505],"tags":[8354,4534,6414,8355,8353],"class_list":["post-7117","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-android-trojan","tag-banking-malware","tag-socks5-proxy","tag-ton-network","tag-trickmo"],"_links":{"self":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts\/7117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/comments?post=7117"}],"version-history":[{"count":0,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/posts\/7117\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/media\/7118"}],"wp:attachment":[{"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/media?parent=7117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/categories?post=7117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/delimiter.online\/blog\/wp-json\/wp\/v2\/tags?post=7117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}