ToxicPanda 2.0 Expands Android Banking Theft With ADB Persistence

Researchers reported that ToxicPanda 2.0 has significantly expanded its Android banking trojan capabilities, targeting more than 140 banking and cryptocurrency apps and using overlay attacks against 349 financial institutions in 16 countries. The updated malware is designed to steal credentials and PINs, including device lock credentials, by presenting fraudulent screens over legitimate apps and harvesting sensitive input from victims.

The malware also deepens persistence by abusing Android Accessibility Service to enable wireless debugging, interact with consent prompts, and gain shell-level access through the Android Debug Bridge (ADB) daemon. That combination allows attackers to grant broad permissions and maintain access to compromised devices even after initial infection, prompting defenders to prioritize controls such as blocking sideloading on managed devices, treating accessibility grants as privileged events, and alerting on developer options or wireless debugging being enabled.