Europe Under Siege by Evolved Banking Trojan

Android users in Europe are currently facing a significant threat from a new iteration of the TrickMo.C banking trojan. This malicious software, first observed in January 2026 and actively developed since September 2019, has undergone numerous upgrades.

The latest TrickMo.C variant is being distributed through deceptive applications masquerading as TikTok and streaming services. Once installed, it creates phishing overlays to harvest user credentials and other sensitive information. The trojan is capable of logging keystrokes, recording the screen, streaming live content to attackers, and intercepting SMS messages.

This sophisticated malware also suppresses One-Time Passwords (OTPs), modifies clipboards, filters notifications, and captures screenshots. Attackers exploit this data to gain unauthorized access to bank accounts and cryptocurrency wallets, facilitating fraudulent transactions. The primary countries affected by this campaign are France, Italy, and Austria.

A notable advancement in this version is its communication method, utilizing TON, a decentralized peer-to-peer network. This allows the malware to communicate with its operators via an encrypted overlay network, enhancing its stealth and making it harder to detect and block.