ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On
Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.
Zimperium zLabs reports ToxicPanda 2.0 (TgToxic) now carries 167 remote commands, targets 349 financial institutions across 16 countries via more than 140 banking and cryptocurrency apps, and abuses Android Wireless Debugging via ADB for privilege escalation and shell access. It harvests lock screen PINs with fake overlays, steals UI elements via accessibility services, sets Device Administrator privileges, and is distributed through Amazon AWS-hosted buckets. IBM Trusteer documents a GoldDigger campaign impersonating airline companies and shopping retailers, causing massive infections in South Africa and the U.K., obfuscated with the dpt-shell packer that detects Frida and resists debugging. GoldDigger performs on-device fraud by injecting input into banking apps and is attributed to the Chinese-speaking GoldFactory actor.
- ToxicPanda 2.0 expands from 16 to 349 targeted financial institutions across 16 countries.
- Malware abuses accessibility services, full-screen overlays, and ADB wireless debugging for privilege escalation.
- GoldDigger uses dpt-shell packer with Frida detection and PTRACE-based anti-debugging.
- GoldDigger is attributed to GoldFactory and impersonates airlines and shopping retailers.
- ATT&CK
- T1056.002 Input Capture: GUI Input CaptureT1562.001 Impair Defenses: Disable Security ToolsT1071.001 Application Layer Protocol: Web Protocols
- Products
- ToxicPandaGoldDiggerdpt-shell
- Threat actors
- GoldFactory
- Organizations
- ZimperiumIBM TrusteerGroup-IB
- Countries
- South AfricaUnited Kingdom
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report , said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.