ToxicPanda 2.0 Uses VPN and Wireless ADB to Target Android Users

Summary

Zimperium says ToxicPanda 2.0 targets 349 finance and crypto apps across 16 countries, using VPN permissions to block Google Play traffic and Wireless ADB for shell access; overlays and spoofed screens steal credentials and device PINs.

Key points

• Zimperium reports that ToxicPanda 2.0 is distributed through Amazon AWS-hosted buckets and targets 349 banking, financial, cryptocurrency, and e-wallet apps across 16 countries.
• The malware requests VPN permissions to block Google Play and Google Play Services traffic before extracting and installing its payload.
• Using Accessibility Services, ToxicPanda enables Developer Options and Wireless Debugging, obtains the ADB pairing code and port, and connects to the device's local ADB service.
• The malware uses ADB shell access to run commands, grant itself permissions, neutralize background restrictions, and maintain persistence.
• Invisible overlays, fake update screens, and a spoofed lock screen are used to capture credentials, PINs, and unlocking patterns; a separate PIN-harvesting module targets 140 financial and cryptocurrency apps.
• ToxicPanda 2.0 supports 167 remote commands, including one that opens manufacturer-specific power-management settings to bypass background-process restrictions.