Loading story…
The Android banking trojan TgToxic has evolved from a Southeast Asia-focused malware operation into a broader campaign targeting victims in Europe and Latin America, while continuing to steal banking credentials, cryptocurrency, and funds. Earlier reporting tied TgToxic to phishing and scam-themed lures delivered through malicious websites and messaging apps such as WhatsApp and Viber, where victims were pushed to install fake Android apps and grant dangerous permissions that enabled attackers to take automated control of infected devices.
Recent analysis found the operators significantly upgraded the malware’s resilience and evasion. A second variant observed in late 2024 hid encrypted command-and-control data behind dead-drop resolvers on 25 community forums, and a third variant shifted to a domain generation algorithm (DGA) to make disruption harder. Newer samples also introduced stronger anti-emulation and anti-analysis checks, including hardware fingerprinting, Android feature validation, and emulator artifact detection, reinforcing assessments that the operators are actively adapting the trojan in response to public reporting and defensive scrutiny.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
From early December 2024, Intel 471 observed a third TgToxic variant that replaced forum-profile dead drops with a domain generation algorithm for command-and-control discovery. The change was assessed as improving resilience and possibly responding to reporting or account removals.
On November 22, 2024, Intel 471 researchers observed a campaign using an updated version of TgToxic. This second observed variant used dead-drop resolvers on 25 community forums to hide encrypted command-and-control information in forum profiles.
In October 2024, Cleafy published research on a new TgToxic version it called the ToxicPanda strain. Cleafy assessed it as still under development and said its targeted app list included European and Latin American banks, indicating geographic expansion beyond Southeast Asia.
Trend Micro described social-engineering campaigns targeting Android users in Taiwan, Indonesia, and Thailand with fake apps, phishing sites, and messaging-app lures. The report said the malware abused Easyclick and Autojs to automate control of infected devices after victims granted permissions.
Researchers observed many scams in Taiwan in August 2022 that abused allowance-assistance distribution themes, and an official agency in Taiwan warned the public about them. Campaign components tied to TgToxic reflected familiarity with these regional lures.
Trend Micro discovered the TgToxic Android banking trojan in July 2022. The malware was designed to steal credentials, cryptocurrency wallet assets, and funds from banking and finance applications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourcetrendmicro.com
Open sourcecleafy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **ToxicPanda 2.0** has significantly expanded its Android banking trojan capabilities, targeting more than **140 banking and cryptocurrency apps** and using overlay attacks against **349 financial institutions in 16 countries**. The updated malware is designed to steal credentials and PINs, including device lock credentials, by presenting fraudulent screens over legitimate apps and harvesting sensitive input from victims. The malware also deepens persistence by abusing **Android Accessibility Service** to enable **wireless debugging**, interact with consent prompts, and gain shell-level access through the **Android Debug Bridge (ADB)** daemon. That combination allows attackers to grant broad permissions and maintain access to compromised devices even after initial infection, prompting defenders to prioritize controls such as blocking sideloading on managed devices, treating accessibility grants as privileged events, and alerting on developer options or wireless debugging being enabled.
Aug 28, 2026
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026
The **Godfather** Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass **2FA**. Researchers said the malware also supports **VNC-style remote control**, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps. Analysis of the malware shows Godfather relying on runtime string decryption with **Blowfish**, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a **Telegram account description** to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than **400 financial organizations** between 2021 and 2022, with renewed campaigns focusing heavily on **Turkey** and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Aug 15, 2026