ToxicPanda 2.0: Advanced Android Banking Trojan Expands Threat to 16 Countries
A new variant of the ToxicPanda Android banking trojan is targeting mobile users with enhanced capabilities, including PIN theft, fake login overlays, and shell-level device control. Researchers at Zimperium identified the malware, which now supports 167 remote commands and can compromise 140+ banking and cryptocurrency apps, while its fraudulent overlays mimic 349 financial institutions across 16 countries.
The malware spreads via malicious files hosted on Amazon AWS buckets, tricking victims into granting VPN and Accessibility Service permissions through a deceptive installation process. Once installed, ToxicPanda monitors apps, captures on-screen data, and logs touch inputs, enabling attackers to steal credentials and maintain persistent access.
A particularly concerning feature is its abuse of Android Wireless Debugging, which allows the malware to enable Developer Options, pair with the local ADB service (127.0.0.1), and gain shell-level access bypassing security protections without physical device access. This technique lets attackers grant additional permissions, disable background restrictions, and reinforce persistence.
ToxicPanda also employs fake lock screens and system update overlays to harvest device-unlock PINs, passwords, and patterns. Its command set includes options to force-reset lock-screen passwords, load phishing pages in full-screen WebView, and evade power-management controls by adjusting vendor-specific battery settings.
Previous versions of ToxicPanda have already infected over 4,500 devices, primarily in Portugal and Spain. The updated variant’s expanded targeting and deeper device control mark a significant evolution in Android banking malware threats.
Source: https://cybersecuritynews.com/toxicpanda-android-malware/
Amazon TPRM report: https://www.rankiteo.com/company/amazon-web-services
"id": "ama1787235879",
"linkid": "amazon-web-services",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '4,500+ devices (primarily in '
'Portugal and Spain)',
'industry': 'Banking, Cryptocurrency',
'location': '16 countries',
'name': '140+ banking and cryptocurrency apps',
'type': 'Financial applications'},
{'industry': 'Banking, Finance',
'location': '16 countries',
'name': '349 financial institutions',
'type': 'Financial institutions'}],
'attack_vector': 'Malicious files hosted on Amazon AWS buckets, phishing '
'(fake overlays), VPN and Accessibility Service permission '
'abuse',
'data_breach': {'personally_identifiable_information': 'Yes (PINs, passwords, '
'patterns, banking '
'credentials)',
'sensitivity_of_data': 'High (financial and personally '
'identifiable information)',
'type_of_data_compromised': 'Credentials, PINs, passwords, '
'patterns, banking and '
'cryptocurrency app data, touch '
'inputs, on-screen data'},
'description': 'A new variant of the ToxicPanda Android banking trojan is '
'targeting mobile users with enhanced capabilities, including '
'PIN theft, fake login overlays, and shell-level device '
'control. The malware supports 167 remote commands and can '
'compromise 140+ banking and cryptocurrency apps, while its '
'fraudulent overlays mimic 349 financial institutions across '
'16 countries. It spreads via malicious files hosted on Amazon '
'AWS buckets, tricking victims into granting VPN and '
'Accessibility Service permissions. Once installed, ToxicPanda '
'monitors apps, captures on-screen data, logs touch inputs, '
'and abuses Android Wireless Debugging to gain shell-level '
'access. It also employs fake lock screens and system update '
'overlays to harvest device-unlock PINs, passwords, and '
'patterns.',
'impact': {'data_compromised': 'Credentials, PINs, passwords, patterns, '
'banking and cryptocurrency app data, touch '
'inputs, on-screen data',
'identity_theft_risk': 'High (PII and financial data theft)',
'operational_impact': 'Persistent device control, unauthorized '
'access to financial apps, potential '
'unauthorized transactions',
'payment_information_risk': 'High (banking and cryptocurrency app '
'credentials stolen)',
'systems_affected': 'Android mobile devices'},
'initial_access_broker': {'backdoors_established': 'Android Wireless '
'Debugging, Accessibility '
'Service permissions',
'entry_point': 'Malicious files hosted on Amazon '
'AWS buckets',
'high_value_targets': 'Banking and cryptocurrency '
'apps, financial '
'institutions'},
'motivation': 'Financial gain (credential theft, banking fraud, '
'cryptocurrency theft)',
'post_incident_analysis': {'root_causes': 'Abuse of Android Wireless '
'Debugging, Accessibility Service '
'permissions, and Developer '
'Options; lack of user awareness '
'about malicious file downloads and '
'permission grants'},
'references': [{'source': 'Zimperium'}],
'response': {'third_party_assistance': 'Zimperium (researchers)'},
'threat_actor': 'ToxicPanda (suspected cybercriminal group)',
'title': 'ToxicPanda 2.0: Advanced Android Banking Trojan Expands Threat to '
'16 Countries',
'type': 'Malware (Banking Trojan)',
'vulnerability_exploited': 'Android Wireless Debugging, Accessibility Service '
'permissions, Developer Options'}