Key Findings New TrickMo variant observed January-February 2026 targeting banking and cryptocurrency users in France, Italy, and Austria Malware now routes command-and-control traffic through The Open Network (TON) blockchain instead of conventional internet infrastructure Runtime-loaded APK module includes new network reconnaissance, SSH tunneling, and SOCKS5 proxy capabilities that turn infected devices into network pivots Embedded TON proxy on infected phones makes malicio
