- The new variant of banking malware expands its reach to 349 financial applications in 16 countries, mainly European.
- It incorporates 167 remote commands, phishing overlays, and a specific module for stealing PIN codes in 140 apps.
- It abuses VPN permissions and the wireless Android Debug Bridge to block Google Play and run commands with elevated privileges.
- Experts recommend exercising extreme caution with accessibility and administrator permissions, and using up-to-date anti-malware solutions.
Cybersecurity researchers have focused on a new variant of the notorious banking Trojan ToxicPanda , dubbed ToxicPanda 2.0. This version not only expands its list of potential victims but also incorporates much more aggressive techniques to control Android devices, steal credentials, and empty bank accounts without raising suspicion. The malware has been detected primarily in Europe, where it already affects 16 countries and more than 340 financial applications.
What worries experts most is that ToxicPanda 2.0 no longer simply steals data through fake screens. It can now remotely take control of the phone, execute commands as if it were the user, and disable Google Play's security measures. All of this with a single objective: to commit financial fraud from the infected device itself, bypassing the security controls that banks use to detect suspicious transactions.
A growing threat: 349 apps in the crosshairs
According to Zimperium's analysis, the new version of the Trojan includes phishing overlays for 349 applications related to online banking, cryptocurrencies, and digital wallets. These overlays perfectly replicate the login or transaction screens of legitimate apps, so the victim enters their credentials without realizing they are sending them to the attacker. The geographic reach is primarily in Europe, although there are also victims in other regions.
Furthermore, ToxicPanda 2.0 includes a specific module for capturing PIN codes in 140 financial and cryptocurrency applications. This module records screen taps as the user enters their PIN and can also spoof the native Android lock screen to obtain the device's unlock pattern or password. In this way, the cybercriminal not only gains access to accounts but can also lock the legitimate owner out.
More sophisticated robbery techniques and security evasion
One of the most striking new features is its ability to display fake system update screens to conceal malicious activity. While the user believes the phone is updating, the malware is stealing credentials or making transfers. ToxicPanda 2.0 has also been detected acting as a dropper: it requests VPN permissions to control network traffic and block communication with Google Play and Google Play Services, allowing it to bypass security checks like Play Protect.
Another worrying technique is the abuse of the wireless Android Debug Bridge (ADB). By exploiting Accessibility permissions, the malware enables wireless debugging and gains shell privileges, allowing it to execute commands with elevated privileges. This facilitates the installation of additional payloads, modification of system settings, and strengthening its persistence on the device. Researchers have observed that the Trojan attempts to prevent Android from closing it, using features like autoboot to remain active in the background.
How it's distributed and how to protect yourself
ToxicPanda 2.0 is distributed through packages hosted on Amazon Web Services, although installation is carried out using social engineering. Attackers trick victims into downloading a malicious application from links in unsolicited messages, advertisements, or purported support communications. Once installed, the app requests excessive permissions, such as access to Accessibility, Device Administrator, or VPN, which are essential for the malware to function.
To avoid infection, experts recommend not installing apps from unauthorized sources and being wary of any permission requests that aren't clearly justified. It's also essential to keep your anti-malware solution up to date and regularly review the permissions granted to apps. If an infection is suspected, you should analyze the signs of malware on Android to act quickly. In severe cases, a factory reset is recommended.
What to do if your device is infected
If you suspect your phone has been compromised, the first step is to activate airplane mode and disable Wi-Fi and Bluetooth to sever communication with the command and control server. Then, use another device to change your banking passwords and notify your bank. Do not interact with fake "system update" screens or unexpected accessibility or VPN notifications.
Boot into safe mode and uninstall any suspicious apps, especially those recently installed. Check device accessibility and administrator permissions, remove any unrecognized VPN profiles, and disable developer options and wireless debugging. If the problem persists, a factory reset is the safest way to remove any traces of malware.
In short, ToxicPanda 2.0 represents a further step in the evolution of banking malware for Android. Its ability to combine overlays, PIN theft, remote control, and security evasion makes it a serious threat to European users. Prevention remains the best defense: be wary of any suspicious permission requests and keep your device updated and protected.
