MEDIUMMalware
Global

TrickMo Android banker adopts TON blockchain for covert comms

·Source: BleepingComputer

Updated:

Executive Summary

A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications. [...]

Analysis

A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications. [...]
Source Attribution

Originally published by BleepingComputer on May 11, 2026.

Related Threats

MEDIUMMalware

Cryptohack Roundup: Banking Trojan Targets Crypto Firms

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-banking-trojan-targets-crypto-firms-image_small-2-a-31683.jpg" align=right hspace=4><b>Also: Indictments in Theft Case, KelpDAO Restarts Operations</b><br>This week, banking Trojan TCLBanker targeted crypto platforms, three people indicted in a violent digital assets-related robbery, Kelp DAO restarted services

Bank Info Security
LOWMalware

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.

CVE-2026-20182
Cisco Talos
LOWMalware

ClickFix finds a backup plan in PySoxy proxy chains

ClickFix, a one-shot social engineering technique that tricks victims into executing malicious workflows disguised as fixes to technical issues in their systems, has got a persistence upgrade. In a one-off instance, ReliaQuest researchers have spotted an intrusion chain using scheduled tasks, PowerShell-based command-and-control (C2), and a unique abuse of the decade-old open-source proxy tool PyS

CSO Online