ToxicPanda 2.0 Adds ADB Pairing, Lock-Screen Theft and Expanded Banking Targets
Summary
zLabs says ToxicPanda 2.0 targets financial apps across 16 countries, using Accessibility overlays to steal credentials. Its analysis details Wireless Debugging/ADB shell access, lock-screen credential theft, and delivery through Amazon AWS-hosted buckets.
Key points
- zLabs describes ToxicPanda 2.0 as an updated Android banking Trojan with 167 remote commands and expanded targeting.
- The malware supports overlays targeting 349 financial institutions and PIN harvesting from more than 140 banking and cryptocurrency apps.
- It uses Android Accessibility Services to enumerate apps, automate device actions, and capture credentials and PINs through overlays.
- The malware can enable Wireless Debugging, extract a six-digit SPAKE2 pairing code, pair with the local ADB daemon, and obtain shell-level access.
- A dropper presents a fake VPN permission screen, blocks communication with Google Play services, and decrypts its payload from the app’s assets.
- ToxicPanda 2.0 uses HTTPS to establish a persistent WebSocket C2 channel; the article says C2 traffic is AES-encrypted in ECB mode.
- The analysis reports lock-screen credential overlays, OEM-specific auto-start bypasses, and delivery from Amazon AWS-hosted buckets.
Article Details
- Attack Vectors
- The dropper presents a fake installation interface and requests VPN permissions, then decrypts and extracts the payload from the app's assets.
- The malware uses Accessibility Services to enumerate installed apps, monitor targeted financial apps, automate device settings, and capture touch input.
- When a targeted app is opened, it displays overlays that imitate login or transaction screens and captures credentials and PINs.
- The malware can spoof the Android lock screen to harvest device PINs, patterns, and passwords, and can display fake system-update screens to obscure activity.
- It automates Android Wireless Debugging pairing by enabling Developer Options, extracting a pairing PIN and dynamic port, and pairing with the local ADB daemon to obtain shell-level access.
- The malware uses Device Administrator prompts and commands to request administrator privileges and can reset the local lock-screen password.
- It establishes HTTPS and persistent WebSocket communications with its C2 server, using AES encryption in ECB mode.
- ToxicPanda 2.0 samples are reported as delivered through Amazon AWS-hosted buckets.
- Defensive Notes
- The article recommends detecting dropper activity before it extracts and installs its hidden payload.
- Monitor for unauthorized Accessibility Service use, automated UI manipulation, Wireless Debugging or ADB pairing, and suspicious device-setting changes.
- Detect and block malicious overlay activity, including spoofed financial-app screens, fake system updates, and lock-screen credential prompts.
- Monitor network activity for the malware's HTTPS and persistent WebSocket C2 communications and access to identified malicious delivery paths.
MITRE ATT&CK
T1036 · MasqueradingIt disguises activity with fake installation and system-update screens and overlays that mimic Android lock screens.T1056.001 · KeyloggingThe malware captures touch input and harvests PINs and credentials through overlays while victims use targeted apps.T1113 · Screen CaptureThe article reports that ToxicPanda 2.0 uses Accessibility Services to capture UI elements displayed on the victim's screen.T1140 · Deobfuscate/Decode Files or InformationThe dropper decrypts and extracts the payload stored in the application's assets folder.T1518.001 · Security Software DiscoveryThe malware enumerates installed applications and sends package names and icons to C2 to identify financial apps.T1548 · Abuse Elevation Control MechanismThe malware abuses Wireless Debugging and Device Administrator prompts to gain shell capabilities and elevated device privileges.
Malware
Vendors
Products
AndroidzLabs identified ToxicPanda 2.0, an updated Android banking Trojan that greatly expands its command set, targeting scope, and fraud capabilities, including PIN theft, lock-screen credential harvesting, and abuse ofGoogle Play[T1562.001 ] Impair Defenses: Disable or Modify Tools – It blocks communication with Google Play/Google Play Services and bypasses background restrictions and OEM power controls (‘block network communication’,Google Play Services[T1562.001 ] Impair Defenses: Disable or Modify Tools – It blocks communication with Google Play/Google Play Services and bypasses background restrictions and OEM power controls (‘block network communication’,
Tools
Industries
BankingzLabs identified ToxicPanda 2.0, an updated Android banking Trojan that greatly expands its command set, targeting scope, and fraud capabilities, including PIN theft, lock-screen credential harvesting, and abuse ofCryptocurrencyThe campaign also shifts delivery to Amazon AWS-hosted buckets and targets 349 financial apps and 140+ banking and cryptocurrency apps across 16 countries.