This devious Android malware has returned disguised as TikTok or streaming apps and now uses blockchain to go unnoticed.

ThreatFabric detected a new TrickMo.C variant targeting Android users in Europe
Disguised as streaming apps/TikTok, it steals credentials, intercepts SMS, suppresses OTP and enables live surveillance.
The victims are mainly in France, Italy and Austria.

Android users across Europe are being attacked with a new variant of a banking Trojan that has been around for a decade, researchers have revealed.

ThreatFabric has explained how it has been tracking a banking Trojan called TrickMo.C since January 2026.

TrickMo is a banking Trojan for Android that was first detected in September 2019, but has been in active development since then and is constantly receiving updates and new features. By 2024, more than 40 variants of TrickMo existed, delivering via more than a dozen droppers and communicating with 22 separate command and control (C2) infrastructures.

Extracting secrets from French, Italians and Austrians

This latest version is disguised as TikTok and streaming apps. The exact implementation mechanism is unknown, but it is safe to assume that criminals advertise it on third-party app repositories, on Telegram and social media channels, as well as through phishing and SEO poisoning.

When installed on the target device, TrickMo.C creates a phishing overlay through which it can collect login credentials and other valuable secrets. It can also record keystrokes, taps and swipes, record screen, live stream contents directly to attackers and intercept SMS messages. You can suppress OTP notifications, modify users’ clipboard, filter notifications, and send screenshots.

All of this allows attackers to steal credentials, log into people’s bank accounts and crypto wallets, make payments and wire transfers, while keeping victims completely in the dark. The victims are mainly in France, Italy and Austria.

What makes TrickMo.C stand out compared to previous versions is that it communicates with its operator via TON, a decentralized peer-to-peer network originally developed around the Telegram ecosystem. Instead of using publicly exposed servers, users communicate with the web over an encrypted overlay network.

The operators use ADNL addresses routed through a built-in local TON proxy running on the infected endpoint.