tokens: An interesting feature of this family of banking Trojans is the simultaneous use of three command sources : Google Cloud Messaging ( GCM ) service – used to send small messages in JSON format to a mobile device via Google servers ; malicious C & C server ; incoming SMS messages .