Product

ToxicPanda

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 20, 2026 · last 22d ago

Timeline2 articles

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On

Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.

Zimperium zLabs reports ToxicPanda 2.0 (TgToxic) now carries 167 remote commands, targets 349 financial institutions across 16 countries via more than 140 banking and cryptocurrency apps, and abuses Android Wireless Debugging via ADB for privilege escalation and shell access. It harvests lock screen PINs with fake overlays, steals UI elements via accessibility services, sets Device Administrator privileges, and is distributed through Amazon AWS-hosted buckets. IBM Trusteer documents a GoldDigger campaign impersonating airline companies and shopping retailers, causing massive infections in South Africa and the U.K., obfuscated with the dpt-shell packer that detects Frida and resists debugging. GoldDigger performs on-device fraud by injecting input into banking apps and is attributed to the Chinese-speaking GoldFactory actor.

The Hacker NewsAug 24, 06:44 UTC · 22d agoMalware in the wild

Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps

Zimperium reports ToxicPanda 2.0, an updated Android banking trojan now targeting more than 140 banking and cryptocurrency apps.

Zimperium has published analysis of ToxicPanda 2.0, an updated Android banking trojan variant. The new variant expands its target list to over 140 banking and cryptocurrency applications. The report lifts the lid on the updated capabilities of the mobile malware family.

Infosecurity MagazineAug 20, 10:00 UTC · 26d agoMalware

Appears with

vendor Zimperium 2 malware GoldDigger 1 malware TgToxic 1 malware ToxicPanda 1 malware ToxicPanda 2.0 1 organization Group-IB 1 threat actor GoldFactory 1 organization Zimperium 1 product dpt-shell 1 product GoldDigger 1 vendor Group-IB 1 vendor IBM Trusteer 1 organization IBM Trusteer 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.