The ToxicPanda Android malware has undergone significant evolution, expanding its targeting to 349 applications across 16 countries and supporting 167 remote commands. A key new feature is its use of VPN service permissions to establish a local network interface, allowing it to control network traffic. This capability, observed in ToxicPanda 2.0, enables the malware to block communications from Google Play and Google Play Services, thereby interfering with security checks, app verifications, updates, and Play Protect interactions.
According to mobile security researchers, ToxicPanda 2.0 is being distributed via Amazon AWS-hosted buckets. After obtaining VPN service permissions, the malware first blocks Google Play communications before extracting and installing its payload, then requests Accessibility Service permissions.
A notable development in the latest ToxicPanda version is its automated abuse of the Android Debug Bridge (ADB). Utilizing Accessibility Services permission, the malware enables Developer Options, activates Wireless Debugging (introduced in Android 11), extracts the six-digit ADB pairing code and port, and connects to the device's local ADB service. This grants the malware shell-level access to infected devices. With shell user permissions, the malware can execute high-privilege commands directly through the ADB daemon, bypassing standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence. This method of abusing wireless ADB has been observed in other Android malware, such as the RedHook malware.
The malware now includes functions to automate ADB, enabling shell-level access. It also supports phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications. A separate PIN-harvesting module targets 140 financial and cryptocurrency apps, with the ability to dynamically update its target list. The app overlays are designed to be invisible to victims, allowing the malware to capture touch inputs. ToxicPanda also spoofs the Android lock screen to capture device PINs, unlocking patterns, and passwords. Some analyzed samples also employed fake system update screens to conceal ongoing malicious activities.
One of the remote commands, "autoBoot," identifies the host device manufacturer and launches OEM-specific auto-start or power management settings. This allows the malware to maintain persistence by bypassing battery consumption protections that terminate background processes on devices from manufacturers such as Xiaomi, OPPO, Vivo, Samsung, and Huawei.
Indicators of compromise (IoCs) associated with the latest ToxicPanda version have been published in a public GitHub repository.
