ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
Zimperium documents ToxicPanda 2.0, an Android banking trojan now targeting 349 financial institutions in 16 countries via ADB privilege escalation and overlay credential theft.
Zimperium's zLabs documented ToxicPanda 2.0, an Android banking trojan expanding from 16 targeted apps to 349 financial institutions across 16 countries, with 167 remote commands. It poses as a dropper, abuses VPN permissions to block Google Play Protect while installing a hidden payload, then uses the Accessibility Service for screen monitoring and overlay-based credential theft. It automates enabling Android Wireless Debugging and completes the pairing handshake to gain ADB shell access for privilege escalation, and overlays fake lock screens to steal device PINs. Previously unfinished commands are now operational and samples are served from AWS-hosted storage buckets.
- Expanded from 16 to 349 targeted financial apps across 16 countries with 167 remote commands
- Uses fake VPN permission prompt to block Google Play Protect while installing payload
- Automates Android Wireless Debugging enablement and pairing for shell-level ADB access
- Overlays fake login and lock screens to steal banking and device credentials
- Now distributed from AWS-hosted buckets; earlier unfinished commands are operational
- Vendors
- Zimperium
- Products
- Google Play Protect
- Malware
- ToxicPanda
From the original article
5 min read at securityaffairs.com
ToxicPanda 2. 0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.