30
30
30
Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps
Zimperium reports ToxicPanda 2.0, an updated Android banking trojan now targeting more than 140 banking and cryptocurrency apps.
Zimperium has published analysis of ToxicPanda 2.0, an updated Android banking trojan variant. The new variant expands its target list to over 140 banking and cryptocurrency applications. The report lifts the lid on the updated capabilities of the mobile malware family.
55
ToxicPanda Banking Trojan Matures Into Enterprise Threat
The ToxicPanda Android banking trojan has matured with new features that expand its global reach beyond users' financial apps.
Researchers report that the latest version of the ToxicPanda Android banking trojan includes new capabilities that broaden its global distribution and increase its threat to enterprises, not just individual users' financial applications. The trojan's evolution signals it is operating at a more professional, enterprise-targeting level. The report outlines expanded features and reach rather than a single incident.
48
30
New Android Malware Steals Banking PINs and Reinstalls Itself After Users Delete Itnew
Zimperium identified RatHat, an Android banking trojan capturing PINs via overlays and abusing Wireless Debugging to reinstall itself after removal.
Zimperium zLabs identified RatHat, an Android banking trojan delivered via smishing, malvertising, and third-party forums, linked to actors apparently operating in China. After abusing Accessibility permissions to enable Wireless Debugging and pair with local ADB for shell access, it installs a Go-based local agent and a Fast Reverse Proxy client in system directories. It uses fake overlays to steal banking, crypto, and payment credentials, intercepts SMS one-time codes, sends screen maps to a generative AI assistant for adaptive automation, and reinstalls itself via /data/local/tmp/app.apk after uninstall.
55
45
30
30
30
30