Malware · 49 days ago
Zimperium’s zLabs said on August 19 that ToxicPanda 2.0 now targets 140+ banking and crypto apps and 349 financial institutions, up from 16 apps in the first wave. The Android banking Trojan is also adding new ways to keep control of a device after it lands.
When a victim opens a target app, the malware fetches a fake overlay from its command server so passwords or PINs go into the attacker’s window. Zimperium says it also abuses Android Accessibility Service to reach wireless debugging and shell access, then uses that path to bypass runtime prompts, enable components, and steal device lock credentials for persistent access.
For organizations that allow sideloading, accessibility-based assistive tools, or managed Android devices with developer options in play, the exposure is in the platform grants themselves as much as in any banking app. That makes this a policy-and-control problem, not something a patch to the app store or the bank can erase.
5 sources covering this story
ToxicPanda Banking Trojan Matures Into Enterprise Threat
The latest version of the Android malware has new features that expand its global reach and put more than users' financial applications at risk.
ToxicPanda Android malware uses VPN permissions to block Google Play
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud
ToxicPanda 2.0 adds 167 remote commands, targets 349 financial institutions, and uses Android accessibility to harvest PINs.
Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps
Zimperium lifts the lid on the ToxicPanda 2.0 Android banking Trojan
Part of the PlainSec briefing for 2026-08-25