New analyses have revealed that the ToxicPanda malware for Android has evolved into a more capable version for controlling infected devices, expanding its list of targeted applications to 349 and adding support for 167 remote commands. The malware targets banking and financial applications, cryptocurrency platforms, and electronic wallets in 16 countries.
According to mobile security company Zimperium, ToxicPanda 2.0 is distributed through containers hosted on Amazon Web Services (AWS). The latest version is not limited to stealing login credentials; it combines the disabling of security services, interception of user interactions, and execution of system-level commands to maintain access to the device.
VPN Privileges to Disable Google Services
The malware requests VPN service privileges to create a local interface through which the device’s network traffic passes. Through this interface, ToxicPanda 2.0 blocks connections to Google Play and Google Play Services before extracting and installing its payload, then requests Accessibility Service privileges.
Control over network traffic gives the malware the ability to interfere with processes such as application verification, update downloads, and Play Protect connectivity, in addition to disabling some of the procedures Android relies on to protect users. The importance of this method lies in the fact that it attacks the communication layer on which security services depend, rather than merely hiding the malicious application inside the device.
Stealing Login Credentials and PINs
ToxicPanda uses phishing overlays targeting financial applications. Zimperium described some of these overlays as invisible to the victim, allowing the malware to capture touch inputs while the targeted applications are being used. The version also includes a separate PIN-collection module targeting 140 financial and cryptocurrency applications, with the ability to update the target list dynamically.
The malware can also imitate the Android lock screen to capture PINs, screen-unlock patterns, and passwords. Researchers observed samples that used fake system-update screens to conceal the malicious activity taking place on the device.
Exploiting Wireless ADB for Broader Access
One of the most notable additions in the version under analysis is the automation of Android Debug Bridge, or ADB, abuse. The malware uses Accessibility Service privileges to enable developer options, activate Wireless Debugging, then extract the six-digit pairing code and port number and connect to the local ADB service over a Wi-Fi network.
After obtaining shell-user privileges, the malware executes commands directly through the ADB daemon, according to Zimperium’s explanation. This allows it to bypass some of Android’s usual consent requests, grant itself extensive privileges, disable background-app execution restrictions, silently enable important components, and enforce persistence mechanisms.
What Does This Mean for Android Users?
The development of ToxicPanda points to a shift in Android malware from credential-theft-only techniques toward attempting to control the device’s own security process. The use of manufacturer-specific settings through the autoBoot command also helps the malware bypass battery-saving procedures that may stop background processes on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices.
Wireless ADB abuse remains a growing trend among Android malware, as Group-IB previously reported a similar mechanism in a recent version of RedHook. Zimperium published a list of indicators of compromise associated with the latest ToxicPanda version in a GitHub repository. The most important practical point is that granting an untrusted application VPN or accessibility privileges, or enabling developer options, may allow it to disable multiple layers of protection at once. However, the source does not specify the number of infected devices or the parties behind the campaign, and this information remains open to review.