Malware operators have traditionally favoured centralised command-and-control infrastructure because it's simple to deploy and scale. But as law enforcement and hosting providers improve takedown capabilities against conventional C2 servers, threat actors are experimenting with alternatives—and blockchain networks are proving appealing. A newly detected variant of the TrickMo Android banking trojan illustrates this shift by leveraging The Open Network (TON) for C2 communications alongside conventional SOCKS5 proxies.
TrickMo's evolution and the TON pivot
TrickMo has circulated as a mobile banking threat for years, refined to steal credentials and cryptocurrency wallet seeds from Android devices. The variant spotted between January and February 2026 introduced a notable change: instead of relying solely on hardcoded IP addresses or traditional domain-based C2, the malware queries TON smart contracts to retrieve its command infrastructure. This approach offers several operational advantages for the attacker.
The trojan still employs runtime-loaded APK modules—code injected or unpacked at execution time—to evade static analysis and app-store detection. But the addition of TON-based C2 adds a layer of resilience. Because TON is a decentralised blockchain network, there is no single authority that can simply revoke or shut down a malicious smart contract in the way that ISPs can null-route an attacking server or registrars can suspend a domain.
Why blockchain infrastructure attracts malware authors
Decentralised ledgers appeal to malware operators for straightforward reasons. First, they provide some degree of anonymity—transactions and contract deployments can be pseudonymous, making attribution harder. Second, they offer distributed redundancy; even if one node goes down, the network persists. Third, the governance model means that takedown requires consensus or technical intervention at scale, not a phone call to a hosting provider.
TON specifically has emerged as a target because it supports smart contracts and has relatively low transaction costs, making it economical to store or update C2 addresses frequently. A malware author can deploy a contract that returns different C2 endpoints based on timestamps, geolocation, or other variables—essentially creating a dynamic, tamper-resistant C2 update mechanism.
The same logic applies to other decentralised systems. We have already seen ransomware gangs and botnets experiment with Ethereum, Monero, and other blockchains. The appeal is the same: operational continuity without reliance on conventional infrastructure that defenders can interdict.
The role of SOCKS5 proxies and the bigger picture
Interestingly, the TrickMo variant also incorporated SOCKS5 proxy chains, suggesting a layered obfuscation strategy. SOCKS5 allows an attacker to route traffic through compromised or rented proxies, further masking the true source of commands. Combined with TON's decentralised addressing, this creates a multi-hop communication path that is difficult to trace.
The target geography—France, Italy, and Austria—reflects TrickMo's traditional focus on European banking and fintech users. However, the infrastructure choices point to a broader trend: malware authors are becoming more infrastructure-aware and are actively adapting to defensive capabilities. They are not waiting for takedown notices; they are shifting to platforms and architectures that are harder to disrupt.
What this means for defenders and the industry
For security teams, the implication is that monitoring traditional C2 signatures—DNS queries, HTTP beacons to known bad IPs—becomes less reliable when malware uses decentralised networks. Detection needs to shift upstream, towards behavioural analysis of the mobile device itself: unusual account access, credential exfiltration, permission escalation, and evidence of cryptocurrency wallet interaction.
ThreatFabric's analysis of the TrickMo variant underscores that the malware threat landscape continues to evolve faster than some defensive measures can adapt. As blockchain platforms mature and become more accessible, their use in malware C2 infrastructure is likely to increase. Hosting providers and infrastructure defenders cannot simply block these networks; they must develop smarter detection and threat intelligence sharing mechanisms.
The broader lesson is that decentralised systems, while valuable for privacy and resilience in legitimate use, also provide malware operators with tools to build attack infrastructure that is harder to take down than conventional hosting. The industry response will likely involve closer monitoring of blockchain transaction patterns, improved behavioural detection on mobile endpoints, and perhaps regulatory pressure on exchanges and wallet providers to flag suspicious contract interactions.
