ToxicPanda 2.0 Android Trojan Expands Attack Scope to Over 140 Financial Apps
A significantly updated Android banking Trojan, dubbed ToxicPanda 2.0, has emerged, dramatically increasing its targeting to over 140 banking and cryptocurrency applications with new credential and PIN theft capabilities.
Zimperium researchers have identified a potent new variant of the ToxicPanda Android banking Trojan, now designated ToxicPanda 2.0. This evolved malware significantly broadens its attack surface, aiming to compromise over 140 distinct banking and cryptocurrency applications, a substantial increase from the 16 targeted by its predecessor.
The malware employs sophisticated techniques to pilfer user credentials and sensitive financial data. A key new feature is a PIN-theft mechanism specifically designed to target these numerous financial applications. Additionally, it utilizes an overlay-based credential theft strategy that encompasses 349 financial institutions globally, with a notable concentration in countries such as Pakistan, South Africa, Mexico, Nigeria, and India.
ToxicPanda 2.0 also demonstrates an alarming abuse of the Android Accessibility Service. This functionality is leveraged to enable wireless debugging, effectively transforming it into a pathway for gaining shell access. Once the malware achieves the necessary user permissions, it can execute high-privilege commands directly through the Android Debug Bridge (ADB) daemon.
This exploitation allows ToxicPanda 2.0 to bypass standard Android runtime consent prompts, granting itself extensive permissions. It can neutralize background restrictions imposed by the operating system, silently activate critical components, and enforce persistence on the compromised device, making removal difficult.
Further enhancing its capabilities, the new variant introduces the ability to steal device lock screen credentials through a screen overlay attack. This allows attackers to gain persistent access to the device, even when the user attempts to lock it, providing a continuous window for malicious activity.
BeyondTrust deputy CISO, Bradley Smith, offered mitigation strategies for enterprises. He recommended blocking sideloading on corporate devices, treating accessibility service grants as privileged access events requiring logging and review, and implementing alerts for the activation of developer options or wireless debugging across managed fleets via Mobile Device Management (MDM).
Smith highlighted that ToxicPanda 2.0's effectiveness stems from its abuse of legitimate Android features rather than exploiting unknown vulnerabilities. "We've been seeing this pattern across mobile threats all year: abuse of legitimate platform features, accessibility services above all, rather than exploitation of vulnerabilities," he stated. "There is no patch for a feature working as designed, so the control plane must move from patching to governing who and what gets those grants."
The evolution of ToxicPanda underscores the persistent and growing threat posed by mobile banking Trojans. As these malware families become more sophisticated in their techniques and expand their targeting, users of financial applications must remain vigilant about app permissions and security practices.
The updated ToxicPanda 2.0 campaign is now leveraging Amazon AWS-hosted buckets for malware delivery, indicating a shift towards cloud infrastructure for distribution. Furthermore, the malware has expanded its capabilities to include siphoning lock screen credentials via fake overlays and automating privilege escalation through Android Wireless Debugging.