New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

What Happened

A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS intercep

This intelligence was reported by AlienVault OTX on 2026-05-11. The activity is associated with the following threat categories: ton network, trickmo, device takeover, godfather, network pivot, socks5 proxy.

Why This Matters

Threats of this type affect organisations that rely on internet-facing infrastructure, cloud services, or employee-facing authentication systems. The window between public disclosure and active exploitation in production environments has narrowed significantly. Security teams that wait more than 48 hours to review new campaigns routinely find themselves responding to incidents that were preventable.

Knowing your organisation's attack surface is the first line of defence. You cannot protect assets you have not mapped.

Who Is at Risk

Organisations running internet-facing services in financial services, critical infrastructure, and enterprise software are the primary targets in campaigns of this type. The techniques involved are not industry-specific. Any organisation with exposed authentication endpoints or unmonitored external assets is a viable target. The threat categories here (ton network, trickmo, device takeover, godfather, network pivot, socks5 proxy) are among the most active in the current landscape.

Indicators of Compromise

If you are investigating whether your environment may be affected, the following indicators of compromise have been identified:

• FileHash-MD5: c25f7fb9f4e1f5f7c2c9c25c0d827b04
• FileHash-MD5: df63a73bf700053d47080f07a612f143
• FileHash-SHA1: 1e4e8c4289d00e54be118e54e1144ac9ebbf4c79
• FileHash-SHA1: eae15d3974eb669b14737e9aa17fc706bd1a7ec8
• FileHash-SHA256: 01889a9ec2abecb73e5e8792be68a4e3bc7dcbe1c3f19ac06763682d63aa8c21
• FileHash-SHA256: 143c0e12d2aa1bdecde59f273139dd5605d00f61cda7f626224e07390119c026

What to Do Now

• Review your external attack surface. Identify assets matching the target profile: exposed authentication endpoints, unpatched services, or credentials that may have been previously exposed.
• Search for the indicators listed above in endpoint logs, network traffic, and SIEM alerts. A match warrants immediate investigation.
• Update detection rules in your SIEM and EDR for the specific file hashes, IP addresses, or behavioural patterns identified in this campaign.
• Validate your incident response playbook covers the threat categories involved. Exercises built on real campaigns outperform generic scenarios.

Frequently Asked Questions

How do I know if my organisation has been affected?

Start with the indicators of compromise above. Run them against your endpoint detection tools, firewall logs, and SIEM. If you find a match, isolate the affected system immediately before taking further action. No matches does not confirm you are unaffected: it means the known indicators were not found. Behavioural analysis and threat hunting are the next steps.

What is the fastest way to reduce exposure to this type of threat?

Close exposed services that should not be publicly reachable, rotate credentials that may have been compromised, and enforce MFA on all external-facing authentication. These steps take hours, not weeks, and reduce exposure across a wide range of active campaigns.

Is this relevant for organisations outside the sectors mentioned?

Yes. The threat categories involved (ton network, trickmo, device takeover, godfather, network pivot, socks5 proxy) are general-purpose techniques reused across industries. Any organisation that has not reviewed its defences against these specific categories in the past 90 days should treat this as a prompt to do so.

How often should we review new threat intelligence?

Campaigns that are new today are actively exploiting vulnerable organisations within 24 to 72 hours of public disclosure. Weekly reviews are the minimum. Automated monitoring that surfaces new campaigns in real time gives your team the lead time needed to act before exploitation begins.