Android banking Trojan TrickMo evolves using TON network for C2

Multiple security incidents and trends reported: ThreatFabric observed a new, stealthier TrickMo Android banking trojan that moved C2 traffic to the TON network for improved persistence; the official JDownloader site was briefly compromised (May 6–7) to distribute malicious installers containing a Python RAT; and cPanel patched three vulnerabilities that could enable file disclosure, RCE, or privilege escalation. U.S. CISA added CVE-2026-42208 (BerriAI LiteLLM, CVSS 9.3) to its Known Exploited Vulnerabilities catalog due to rapid exploitation. Other notable items include SailPoint disclosing a