This threat is a redesigned variant of the TrickMo Android banking trojan discovered between January and February 2026. Unlike previous versions, it has migrated its command-and-control infrastructure to The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. The malware targets users of banking, fintech, wallet, and authentication applications in France, Italy, and Austria. Once accessibility permissions are granted, operators gain extensive real-time control over the device, including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance and SSH tunneling, which allow the infected device to function as a programmable network pivot and SOCKS5 proxy exit node. This capability helps attackers evade IP-based fraud detection systems while accessing victim networks. The malware hashes are provided for detection purposes. There is no indication of known exploits in the wild or available patches.

The malware enables attackers to take full control of infected Android devices with granted accessibility permissions. This includes stealing credentials, intercepting SMS messages, recording screens, logging keystrokes, and remotely controlling the device. The addition of network reconnaissance and SSH tunneling allows attackers to use infected devices as network pivots and proxy nodes, facilitating stealthy lateral movement and evasion of IP-based fraud detection. The targeting of banking, fintech, wallet, and authentication apps in specific European countries suggests a focused financial crime impact. No known exploits in the wild have been reported yet, but the capabilities pose a significant risk to affected users.

No official patch or remediation guidance is currently available for this malware variant. Since it relies on accessibility permissions to gain control, users and organizations should be cautious about granting such permissions to untrusted applications. Monitoring for indicators of compromise such as the provided malware hashes can aid detection. Users in affected regions should be vigilant for suspicious app behavior and avoid installing apps from untrusted sources. Security teams should consult the referenced vendor advisory and threat intelligence sources for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.