A significantly upgraded version of the ToxicPanda Android malware, dubbed ToxicPanda 2.0, has expanded its targeting to 349 financial applications across 16 countries, a substantial increase from the 16 applications it previously targeted. Researchers at Zimperium's zLabs team documented the new variant, noting its command set has grown to 167 remote instructions.
The infection process for ToxicPanda 2.0 begins with the malware masquerading as a legitimate application. It requests VPN permissions through a deceptive installation screen, then leverages this access to disable Google Play Protect. Subsequently, it decrypts and installs its primary payload, which is hidden within the app's asset files.
Upon installation, the malware abuses Android's Accessibility Service. This service, typically used by legitimate tools like screen readers, allows ToxicPanda to monitor and interact with user interface elements on the victim's screen. This capability is central to its overlay-based credential theft mechanism, which targets the expanded list of 349 financial institutions.
A key new feature in ToxicPanda 2.0 is its ability to automate the activation of Android's Wireless Debugging framework. The malware can programmatically tap the build number seven times to unlock developer options, toggle wireless debugging, and then extract the six-digit pairing code from the screen using accessibility permissions. It then performs the cryptographic pairing handshake, granting itself shell-level access to the device without user intervention or awareness that developer mode has been enabled.
This access through Android Debug Bridge (ADB) allows ToxicPanda to execute commands without displaying the usual permission prompts. This enables it to escalate its own permissions, bypass Android's restrictions on background activity, enable critical components covertly, and maintain persistent access to the compromised device.
The credential theft operations are multifaceted. For banking and cryptocurrency applications, the malware detects when a targeted app is opened and then either overlays a fake login screen or deploys a transparent layer to capture touch inputs and PIN entries. Additionally, ToxicPanda 2.0 can now overlay a convincing replica of the phone's lock screen to steal the device's PIN, pattern, or password, providing attackers with a means to regain access even after the initial infection.
Several capabilities that were previously identified as unimplemented in earlier ToxicPanda variants by security firm Cleafy are now fully operational. The malware can automatically navigate OEM-specific permission dialogs on customized Android builds from manufacturers such as Xiaomi, Samsung, and Huawei. It can also request Device Administrator privileges using a fake system service prompt and remotely force-reset a victim's lock screen password by exploiting legitimate Android device management APIs. Furthermore, it can load attacker-controlled webpages within a full-screen overlay.
