ToxicPanda 2.0, an evolved Android banking Trojan that significantly expands its fraud, device control, and credential theft capabilities.
The updated malware uses invisible overlays to capture PIN input from more than 140 banking and cryptocurrency applications, while its broader phishing framework targets 349 banking, financial, e-wallet, and crypto applications across 16 countries.
ToxicPanda was previously associated primarily with campaigns against European users, but version 2.0 signals a substantial global expansion.
The malware now supports 167 remote commands, compared with the more limited and partly unfinished functionality documented in earlier research by Cleafy.
Several commands that were previously present but unimplemented are now operational, giving operators a more mature platform for fraud, persistence, phishing, and post-compromise device control.
The most concerning addition is a transparent overlay mechanism designed to steal PINs entered into targeted financial applications.
ToxicPanda monitors the foreground app through Android Accessibility Services, then checks whether its package matches a remotely configurable target list.
When a victim opens a banking, wallet, payment, or cryptocurrency application, the malware can place an effectively invisible touch-capturing layer over the legitimate interface.
Unlike a conventional phishing screen, this technique allows the victim to interact with what appears to be the authentic application while their touch input is intercepted by the overlay.
The capability can be refreshed remotely through the replacePinTargets command, enabling operators to replace package names and keywords without requiring a new malware build.
ToxicPanda also retains HTML-based phishing overlays that mimic login and transaction pages.
These overlays are retrieved from the command-and-control server after the malware identifies targeted apps installed on the device, allowing attackers to harvest credentials, PINs, and other sensitive payment data.
It programmatically navigates to device settings, enables Developer Options by simulating taps on the build number, turns on Wireless Debugging, and opens the pairing workflow.
It then scrapes the six-digit pairing code and dynamic port shown in the pairing dialog. Using these values, the malware performs local SPAKE2-based authenticated pairing with the ADB daemon and obtains shell-level access.
This enables it to execute commands that can bypass ordinary runtime consent flows, broaden permissions, reduce background restrictions, activate components, and reinforce persistence.
The zLabs team recently identified ToxicPanda 2.0, abuses Accessibility Services to automate the Android Wireless Debugging setup process, a feature introduced in Android 11 for Wi-Fi-based Android Debug Bridge connectivity.
ToxicPanda 2.0 operates as a dropper. It first displays a fake installation screen in a WebView and asks the victim to grant VPN privileges.
ToxicPanda 2.0 Steals PINs
The requested VPN access is used to obstruct communications from Google Play and Google Play Services before the hidden payload is decrypted from the application’s assets and installed.
The malware communicates with its C2 server through an HTTPS handshake followed by a persistent WebSocket channel, giving operators low-latency, bidirectional command execution.
Its communications remain AES-encrypted in ECB mode using a key embedded in the source code. Researchers also observed delivery through Amazon AWS-hosted buckets, reflecting the actors’ use of legitimate cloud infrastructure for malware distribution.
Beyond financial fraud, ToxicPanda 2.0 can deploy spoofed Android lock-screen overlays to harvest unlock PINs, patterns, and passwords.
Capturing those credentials gives operators a path to bypass screen-lock protections and retain access to a compromised device.
Some samples also show full-screen fake system-update templates to conceal malicious activity while background actions occur.
Newly functional commands include admSet, which requests Device Administrator privileges using a “System service requires administrator privileges” lure, and admPwd, which can attempt to reset the device lock credential with an attacker-specified value.
The autoBoot capability further adapts to vendor-specific power-management controls on OEMs including Xiaomi, OPPO, Vivo, Samsung, and Huawei, using Accessibility-driven navigation to preserve background execution.
For defenders, the campaign reinforces the risk of sideloaded Android apps requesting Accessibility, VPN, Device Administrator, or Developer Options-related permissions.
Financial application developers should also harden sensitive screens against overlay abuse and continuously assess device integrity and suspicious accessibility-service activity.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
