Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps

Security researchers have warned of a new variant of a prolific Android banking Trojan which substantially expands its potential victim count.

ToxicPanda 2.0 was discovered by Zimperium’s zLabs team, the mobile security vendor wrote in a post on August 19.

Most notable is a PIN-theft mechanism designed to target 140 banking and cryptocurrency applications, and an overlay-based credential theft mechanism targeting 349 financial institutions.

That’s a big increase on the 16 banking apps the first iteration of the Android malware targeted.

Read more on Android malware: Mirax Android Trojan Turns Devices Into Residential Proxy Nodes

When the victim launches one of the targeted applications, the malware requests the relevant malicious HTML overlay from its C2 server. According to the report, most of the financial institutions across 16 countries are in Pakistan, South Africa, Mexico, Nigeria and India.

One of the new features is its abuse of the Android Accessibility Service that enables wireless debugging. It effectively tries to turn this functionality into a route to shell access.

“Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB [Android Debug Bridge] daemon,” the report noted. “The malware bypasses standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence.”

Also new to ToxicPanda 2.0 is the ability to steal device lock credentials via a screen overlay attack, granting an attacker persistent access to a compromised device.

Three Controls to Mitigate ToxicPanda

BeyondTrust deputy CISO, Bradley Smith, suggested three ways for enterprises to mitigate the impact of the Android Trojan.

• Block sideloading on any device enrolled in corporate identity
• Treat accessibility service grants as privileged access events, which are subject to logging and review
• Alert when developer options or wireless debugging switch on across the managed fleet. This is possible via mobile device management (MDM)

“What stands out to me in this research is that ToxicPanda 2.0 does not break Android, it operates Android,” Smith argued.

“We've been seeing this pattern across mobile threats all year: abuse of legitimate platform features, accessibility services above all, rather than exploitation of vulnerabilities. There is no patch for a feature working as designed, so the control plane must move from patching to governing who and what gets those grants.”