Eine neue Version des Android-Trojaners ToxicPanda bedroht weltweit Nutzer von Finanz- und Krypto-Anwendungen. Die Schadsoftware hebelt Sicherheitsfunktionen aus und übernimmt die fast vollständige Ko...

Más de 1.500 dispositivos Android han sido infectados por ToxicPanda, un troyano bancario que permite a los actores maliciosos realizar transacciones bancarias fraudulentas. La mayoría de las infec…

ToxicPanda 2.0 fängt 2FA-Codes ab und blockiert Google Play auf 349 Banking-Apps in 16 Ländern. So erkennst du die Infektion und schützt dein Gerät.

The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.

ToxicPanda 2.0 bedroht Android-Nutzer und Banking-Apps. Erfahren Sie, wie der Trojaner funktioniert und welche Maßnahmen Ihr Smartphone schützen.

VÍRUS "TOXICPANDA" SE APROXIMA DO BRASIL E JÁ ESTÁ NA AMÉRICA LATINA

A new version of the ToxicPanda Android banking trojan is widening the danger for mobile users. The malware can steal banking PINs, imitate trusted screens, and take deeper control of infected phones through a feature intended for developers. ToxicPanda 2.0 arrives with a far broader set of targets and remote commands than earlier versions. It is delivered through malicious files hosted in Amazon AWS buckets, then uses a fake installation flow to persuade victims to approve sensitive Android permissions. Researchers at Zimperium identified the updated malware and said it has 167 remote commands. The campaign can target more than 140 banking and cryptocurrency apps for PIN theft, while its fake login overlays now cover 349 financial institutions across 16 countries. The scale matters because the attack does not rely on one stolen password alone. Once installed, ToxicPanda can monitor apps, collect on-screen information, capture touch input, display deceptive pages, and help attackers keep access to the device. Earlier ToxicPanda activity had already infected more than 4,500 devices, largely in Portugal and Spain. Zimperium said in a report shared with Cyber Security News (CSN) that the new variant also uses Android Wireless Debugging to obtain shell-level access. That technique gives criminals a route to run commands and weaken normal Android protections without needing physical access to the phone. ToxicPanda Android Malware The infection begins with a dropper app that displays a false installation interface and asks for VPN-related permission. This may let the malware interfere with connections to Google Play and Google Play Services before it decrypts and installs its concealed payload. Dropper requesting VPN permission to the victim before payload installation (Source – Zimperium) Accessibility permissions are central to the operation. They allow ToxicPanda to inspect what appears on screen and interact with the interface, a pattern also seen in  Android banking trojan attacks  that use fake sign-in windows to capture account details. Malware installs the payload and requests Accessibility Service permissions (Source – Zimperium) After installation, ToxicPanda inventories the applications on the device and sends their package names and icons to its command-and-control server. When a victim opens a selected financial app, the server can return a matching HTML overlay that resembles the genuine login or payment screen. The malware can also place a transparent layer over a banking keypad to record the victim’s taps. Its  <replacePinTargets>  command lets operators update the list of apps and keywords used for PIN collection, allowing campaigns to change targets without issuing a new malicious app. Malware overlays on top of the victim’s screen (Source – Zimperium) Its Wireless Debugging abuse is especially concerning. ToxicPanda uses automated screen interactions to enable Developer Options, turn on Wireless Debugging, trigger pairing, and collect the temporary six-digit pairing code. It then pairs with the local ADB service at  127.0.0.1  and gains shell user capabilities. With shell-level access, the malware can attempt to grant itself permissions, bypass background restrictions, enable components quietly, and improve its persistence on the device. This expands the threat beyond a conventional credential-stealing app. Overlays Hide Persistent Control ToxicPanda can also steal device-unlock PINs, passwords, and patterns using a fake Android lock screen. The overlay is designed to resemble the legitimate screen, turning a routine unlock attempt into another credential collection opportunity. In some samples, the attackers use a fake full-screen system update to conceal malicious activity. This social-engineering method can keep users occupied while the malware changes settings or waits for sensitive information, echoing tactics described in  fake Google Play updates  used by other Android banking threats. Malware overlay used to steal password of the victim (Source – Zimperium) The updated command set includes options to request Device Administrator privileges and force-reset the phone’s lock-screen password. Another command can load an attacker-controlled web page in a full-screen WebView, giving criminals another way to present phishing content or misleading prompts. ToxicPanda also attempts to survive Android power-management controls. It identifies the device manufacturer and uses Accessibility Services to navigate vendor-specific auto-start and battery settings, aiming to prevent the operating system from stopping its background processes. Similar abuse of accessibility-driven device control has become a recurring feature of  modern Android banking malware . Users should avoid installing APK files from unsolicited links or unofficial download pages. They should treat unexpected requests for Accessibility Service, Device Administrator, VPN, Developer Options, or Wireless Debugging permissions as a warning sign, especially when the requesting app is not clearly trusted. Organizations should watch for unusual Accessibility activity, automated changes to developer settings, suspicious overlay behavior, and unexpected ADB pairing events. Removing unrecognized apps promptly and reviewing enabled accessibility services can help limit exposure before criminals can establish persistent control. Indocators of compromise (IoCs):- Type Indicator Description IP address 127.0.0.1 Local ADB daemon address used during ToxicPanda’s Wireless Debugging pairing process.  Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs:  Integrate TI Lookup in your SOC The post ToxicPanda Android Malware Can Steal Banking PINs and Gain Shell Access to Phones appeared first on Cyber Security News .

New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers

Discover Cleafy's in-depth analysis of a new Android banking Trojan campaign, ToxicPanda, initially linked to TgToxic. Our findings reveal a sophisticated fraud operation targeting European and LATAM ...

What is ToxicPanda? Bitsight Trace dives into detail on the banking malware, from impact breadth, delivery, technical analysis, and more. Learn more now.

Cybersecurity Threat Research 'Weekly' Recap. This week covered government/health phishing schemes for refund and reimbursement theft, plus Microsoft 365 session hijacking via AiTM tooling and broader crypto fraud using fake AML checkers, wallet apps, and stealer pipelines. Across malware delivery, supply chain, and cloud/identity abuse, researchers tracked campaigns involving ToxicPanda 2.0, ClearFake-to-Amatera chains, StopAndProtect WordPress intrusions, and covert infrastructure using BOFScale and Cloudflare Workers, alongside defensive guidance and emerging AI security benchmarking (EchoBench, AVDH). #Mirage2FA #OperationASTERIX #ToxicPanda #ClearFake #Amatera #StopAndProtect #BRIDGEHEAD #BOFScale #CloudflareWorkers #EchoBench #BTRsys #Cruciferra

ToxicPanda 2.0 blockiert Google Play per VPN, missbraucht Wireless ADB und nimmt Hunderte Finanz- und Krypto-Apps ins Visier.

ToxicPanda 2.0 targets 140+ banking apps, steals PINs, overlays screens, and uses 167 commands to control Android devices.

Esto es todo lo que sabemos sobre ToxicPanda, el nuevo software malicioso que está infectando dispositivos en países europeos.

ToxicPanda 2.0 fängt 2FA-Codes ab und blockiert Google Play auf 349 Banking-Apps in 16 Ländern. So erkennst du die Infektion und schützt dein Gerät.

ToxicPanda 2.0 Trojan is now here, and it's a new and improved version of the initial malware. It can now affect 349 banking apps.

The latest version of the Android malware has new features that expand its global reach and put more than users' financial applications at risk.