Loading story…
Researchers reported that ToxicPanda 2.0 has significantly expanded its Android banking trojan capabilities, targeting more than 140 banking and cryptocurrency apps and using overlay attacks against 349 financial institutions in 16 countries. The updated malware is designed to steal credentials and PINs, including device lock credentials, by presenting fraudulent screens over legitimate apps and harvesting sensitive input from victims.
The malware also deepens persistence by abusing Android Accessibility Service to enable wireless debugging, interact with consent prompts, and gain shell-level access through the Android Debug Bridge (ADB) daemon. That combination allows attackers to grant broad permissions and maintain access to compromised devices even after initial infection, prompting defenders to prioritize controls such as blocking sideloading on managed devices, treating accessibility grants as privileged events, and alerting on developer options or wireless debugging being enabled.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Zimperium reported that ToxicPanda 2.0 expanded its targeting from 16 financial institutions to 349 banking, e-wallet, and cryptocurrency applications and was observed operating across 16 countries. The updated malware also added 167 remote commands, reflecting a broader escalation from banking fraud toward persistent device compromise.
Zimperium reported that ToxicPanda 2.0 evolved to abuse Android VPN permissions to block Google Play and Play Services communications, interfere with Play Protect workflows, and install payloads before requesting Accessibility access. The updated malware also automates Wireless ADB on Android 11+ to gain shell-level access, bypass runtime consent prompts, and strengthen persistence while expanding overlays and PIN theft targeting.
Zimperium's zLabs team discovered the new ToxicPanda 2.0 Android banking trojan variant and published its research. The report described expanded targeting, PIN theft, overlay-based credential theft, and persistence via abuse of Android accessibility and wireless debugging features.
A current GoldDigger Android banking trojan campaign impersonated airline companies and shopping retailers and caused widespread infections in South Africa and the U.K. The malware abused accessibility permissions to perform on-device banking fraud, including injecting input into banking apps to initiate fraudulent transactions.
The earlier iteration of the ToxicPanda Android banking trojan targeted 16 banking applications, providing the baseline from which the newer variant expanded.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceinfosecurity-magazine.com
Open sourcezimperium.com
Open sourceibm.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Android banking trojan **TgToxic** has evolved from a Southeast Asia-focused malware operation into a broader campaign targeting victims in Europe and Latin America, while continuing to steal banking credentials, cryptocurrency, and funds. Earlier reporting tied TgToxic to phishing and scam-themed lures delivered through malicious websites and messaging apps such as WhatsApp and Viber, where victims were pushed to install fake Android apps and grant dangerous permissions that enabled attackers to take automated control of infected devices. Recent analysis found the operators significantly upgraded the malware’s resilience and evasion. A second variant observed in late 2024 hid encrypted command-and-control data behind dead-drop resolvers on 25 community forums, and a third variant shifted to a **domain generation algorithm (DGA)** to make disruption harder. Newer samples also introduced stronger anti-emulation and anti-analysis checks, including hardware fingerprinting, Android feature validation, and emulator artifact detection, reinforcing assessments that the operators are actively adapting the trojan in response to public reporting and defensive scrutiny.
Aug 15, 2026
Researchers documented multiple evolutions of the **BianLian** Android banking trojan, showing a malware family that abuses **Accessibility Services** to seize control of infected devices, hide its launcher icon, deploy overlay attacks, intercept SMS, execute USSD commands, lock screens, and target banking and cryptocurrency users. Fortinet reported a heavily obfuscated variant that dynamically loads a secondary APK downloaded from command-and-control infrastructure rather than decrypting it from app assets, and noted that the payload checks whether **Google Play Protect** is enabled through the **SafetyNet API**. Later analysis of a newer sample found BianLian continuing to broaden both its infrastructure and victim scope, using a **Tor onion service** to deliver a Base64-encoded JSON configuration containing multiple C2 domains and targeting **438 mobile applications**, primarily banking apps. The malware also added or refined remote-access capabilities including **screen recording** via `MediaProjection` and a **SOCKS5/SSH proxy** with remote port forwarding, while reorganizing code to improve persistence and evasion on major Android vendors by handling battery optimizations, disabling Huawei and Samsung protections, and enabling autostart on Xiaomi MIUI devices.
Aug 15, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026