TrickMo

Cybersecurity researchers have discovered a new variant of the TrickMo Android banking trojan that uses The Open Network for command-and-control and targets users in France, Italy, and Austria. The new variant was observed between January and February 2026 and relies on a runtime-loaded APK. It actively targets banking and cryptocurrency wallet users.

A new variant of the TrickMo Android banking malware has been discovered, targeting users in Europe with new commands and stealthy communication methods. The malware uses The Open Network (TON) blockchain for covert command-and-control communications. This development indicates an increase in sophistication of the malware.