Full Report
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. [...]
Analysis Summary
# Tool/Technique: ToxicPanda (Version 2.0)
## Overview
ToxicPanda is an advanced Android banking trojan designed to perform financial fraud. The 2.0 variant has evolved significantly, focusing on network-level interference via VPN permissions and shell-level access through the automated abuse of Android Wireless Debugging (ADB). Its primary purpose is to capture credentials and PINs for banking and cryptocurrency applications and conduct unauthorized transactions.
## Technical Details
- **Type:** Malware family (Banking Trojan)
- **Platform:** Android (v11 and above for specific Wireless ADB features)
- **Capabilities:** Phishing overlays, PIN harvesting, network traffic blocking, ADB shell access, persistence management, and remote command execution.
- **First Seen:** Reported as version 2.0 in August 2026.
## MITRE ATT&CK Mapping
- **[TA0031 - Network Effects]**
- **[T1618 - Adversary-in-the-Middle]** (Abusing VPN permissions to intercept/block traffic)
- **[TA0003 - Persistence]**
- **[T1624.001 - Event Triggered Execution: Accessibility Service]**
- **[TA0006 - Credential Access]**
- **[T1411 - Input Capture]** (Phishing overlays and PIN harvesting)
- **[TA0002 - Execution]**
- **[T1626 - Abuse Elevation Control Mechanism]** (Abusing ADB for shell access)
## Functionality
### Core Capabilities
- **VPN Service Abuse:** Creates a local VPN interface to intercept and block network traffic, specifically targeting Google Play and Google Play Services to prevent security updates and Play Protect checks.
- **Phishing Overlays:** Supports 349 applications (banking, crypto, e-wallets) across 16 countries, using invisible overlays to capture user touch inputs and credentials.
- **PIN Harvesting:** A specialized module targeting 140 apps to steal device and application-specific PINs, patterns, and passwords.
### Advanced Features
- **Wireless ADB Automation:** Automatically enables Developer Options and Wireless Debugging via Accessibility Services. It captures the pairing code to gain shell-level permissions, allowing it to bypass runtime consent prompts.
- **Persistence (autoBoot):** Identifies the device manufacturer (Samsung, Xiaomi, Huawei, etc.) to navigate specific power management settings and ensure the background process is not killed by the OS.
- **Remote Command Support:** Includes a library of 167 remote commands for extensive control over the infected device.
## Indicators of Compromise
*Note: Refer to Zimperium’s official repository for the complete and most current list of hashes.*
- **File Hashes:** Specific SHA256 hashes are documented in the Zimperium GitHub IOC repository (2026-08-ToxicPanda).
- **Network Indicators:**
- C2 infrastructure often hosted on Amazon AWS-based S3 buckets (defanged: `s3[.]amazonaws[.]com/[bucket-name]`).
- **Behavioral Indicators:**
- Sudden requests for VPN Service permissions from non-VPN apps.
- Unexpected activation of "Developer Options" or "Wireless Debugging."
- Overlay screens appearing over financial applications or the system lock screen.
## Associated Threat Actors
- Currently attributed to unidentified cybercriminals specializing in mobile financial fraud; shares TTPs (Wireless ADB abuse) with the **RedHook** malware family.
## Detection Methods
- **Signature-based detection:** Scanning for known ToxicPanda 2.0 APK hashes and unique string constants in the code.
- **Behavioral detection:** Monitoring for the sequence of enabling Accessibility Services followed by immediate manipulation of Developer Settings and ADB.
- **YARA rules:** Rules targeting the specific `autoBoot` function logic and the ADB pairing code extraction routine.
## Mitigation Strategies
- **User Education:** Advise users never to enable "Accessibility Services" or "Developer Options" for apps that do not legitimately require them.
- **Hardening:** Disable "Wireless Debugging" unless actively used for development.
- **Network Security:** Use Mobile Threat Defense (MTD) solutions that can detect the creation of unauthorized VPN tunnels or local proxies.
- **App Sourcing:** Strictly prohibit the installation of applications from "Unknown Sources" or third-party buckets (e.g., AWS S3 links).
## Related Tools/Techniques
- **RedHook:** Another Android malware family utilizing Wireless ADB for shell access.
- **Accessibility Logging:** A common technique used by many Android trojans (like TeaBot or Xenomorph) to facilitate overlays.