.jpg "TrickMo Android banker adopts TON blockchain for covert comms")
A new TrickMo Android banking malware variant, tracked as Trickmo.C, is being spread through fake TikTok and streaming apps to target banking and crypto wallet users in France, Italy, and Austria. The latest version uses TON-based communications with .ADNL addresses to obscure its command-and-control infrastructure and adds new networking and remote-access commands. #TrickMo #TrickmoC #ThreatFabric #TON
Keypoints
- TrickMo has been active since 2019 and continues to evolve.
- ThreatFabric identified the latest variant as Trickmo.C.
- The malware is being delivered through fake TikTok and streaming apps.
- TON and .ADNL addresses are used to hide command-and-control traffic.
- New commands add networking and tunneling capabilities, including SSH and SOCKS5 support.