Security researchers have identified a new variant of the ToxicPanda Android banking Trojan, dubbed ToxicPanda 2.0, which significantly expands its targeting capabilities. The zLabs team at Zimperium, a mobile security vendor, detailed their findings in a report published on August 19.
ToxicPanda 2.0 introduces a PIN-theft mechanism specifically designed to compromise over 140 banking and cryptocurrency applications. This represents a substantial increase from the original ToxicPanda, which targeted only 16 banking applications. Additionally, the new variant employs an overlay-based credential theft mechanism that affects 349 financial institutions.
The majority of the targeted financial institutions are located across 16 countries, with a notable concentration in Pakistan, South Africa, Mexico, Nigeria, and India. When a victim launches one of the applications on the target list, the malware retrieves a malicious HTML overlay from its command-and-control (C2) server.
A key new feature in ToxicPanda 2.0 is its abuse of the Android Accessibility Service to enable wireless debugging, effectively creating a pathway to shell access. Once the malware obtains shell user permissions, it can execute high-privilege commands directly through the Android Debug Bridge (ADB) daemon. This allows the malware to bypass standard Android runtime consent prompts, grant itself extensive permissions, disable OS background restrictions, silently activate critical components, and establish persistence on the device.
Another new capability is the ability to steal device lock credentials through a screen overlay attack. This grants attackers persistent access to a compromised device, further solidifying their control.
To mitigate the threat posed by ToxicPanda 2.0, cybersecurity experts recommend several controls for enterprises. These include blocking sideloading on all devices enrolled in corporate identity management systems, treating grants to accessibility services as privileged access events subject to logging and review, and configuring mobile device management (MDM) systems to alert administrators when developer options or wireless debugging are activated across managed fleets.
Analysts note that ToxicPanda 2.0 does not exploit vulnerabilities in Android but rather abuses legitimate platform features, particularly accessibility services, to achieve its objectives. This approach means there is no traditional patch for the malware, shifting the focus of defense from patching to governing who and what receives these powerful grants.
