Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps

Security researchers have warned of a new variant of a prolific Android banking Trojan which substantially expands its potential victim count.

ToxicPanda 2.0 was discovered by Zimperium’s zLabs team, the mobile security vendor wrote in a post on August 19.

Most notable is a PIN-theft mechanism designed to target 140 banking and cryptocurrency applications, and an overlay-based credential theft mechanism targeting 349 financial institutions.

That’s a big increase on the 16 banking apps the first iteration of the Android malware targeted.

When the victim launches one of the targeted applications, the malware requests the relevant malicious HTML overlay from its C2 server. According to the report, most of the financial institutions across 16 countries are in Pakistan, South Africa, Mexico, Nigeria and India.

One of the new features is its abuse of the Android Accessibility Service that enables wireless debugging. It effectively tries to turn this functionality into a route to shell access.

“Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB [Android Debug Bridge] daemon,” the report noted. “The malware bypasses standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence.”