ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

ToxicPanda 2.0 Android Banking Trojan Expands to 349 (TL-2026-2128), also tracked as ToxicPanda v2, is a high-severity malware campaign, first published 2026-08-24. It is linked to a China-nexus actor with low confidence, affects Google Android OS, maps to 20 MITRE ATT&CK techniques (T1406, T1407, T1417.001), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2128

Threat ID
TL-2026-2128
Also known as
ToxicPanda v2
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-24
Last reviewed
2026-08-24
Attribution confidence
LOW
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
banking, financial services, e-wallet digital payments, cryptocurrency
Target regions
pakistan, south africa, mexico, nigeria, india, indonesia, panama, italy, portugal, spain, france, germany
Detection rules
9
Indicators of compromise
24

Malware and tooling in ToxicPanda 2.0 Android Banking Trojan Expands to 349

Malware and tooling: TgToxic, ToxicPanda, ToxicPanda v2 WebSocket C2 panel

ToxicPanda, an Android banking trojan first disclosed by Cleafy in late 2024 targeting Europe and Latin America, has matured into version 2.0 with 167 remote commands and phishing-overlay coverage of 349 banking, e-wallet, and cryptocurrency applications across 16 countries. Zimperium zLabs documents new privilege-escalation techniques abusing wireless ADB debugging, Android Accessibility Service, and the Device Administrator API, with samples now distributed via Amazon AWS-hosted S3 buckets and Telegram bot hosting.

How ToxicPanda 2.0 Android Banking Trojan Expands to 349 works

ToxicPanda 2.0 is a major capability escalation of the ToxicPanda Android banking trojan. Later reporting (The Hacker News, citing Zimperium) places the family's activity as far back as approximately July 2022, but it was first publicly documented by Cleafy Labs in November 2024 as a Southeast-Asia-origin family -- sharing 61 commands with the TgToxic trojan, and carrying artifacts pointing to Chinese-speaking operators, including a hardcoded reference to the Chinese 114DNS resolver (114.114.114.114) and embedded Chinese-language strings. That original wave infected over 1,500 Android devices across 16 banking apps, delivered via social-engineered side-loading using icons that mimicked Chrome, VISA, and dating apps, and concentrated in Italy (56.8% of infections), Portugal (18.7%), Hong Kong (4.6%), with further activity in Spain, Peru, France, Germany, and the UK; it used three hardcoded C2 domains (dksu[.]top, mixcom[.]one, freebasic[.]cn) and a static AES-ECB key, and already supported on-device-fraud (ODF) account takeover, OTP interception, and photo-album exfiltration.

Zimperium zLabs' August 2026 analysis shows the operators have since rebuilt the malware into a 167-command remote-access platform with fake phishing overlays covering 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, with reporting naming Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama among the targeted markets.

The infection chain begins with a dropper that requests VPN service privileges (to block Google Play Protect communication) and presents a fake WebView-based installation interface before decrypting and installing the main payload from the app's assets folder. On first run the payload requests Accessibility Service permission, enumerates the device's installed applications, and transmits their package names and icons to the C2 as part of registration. It then abuses Accessibility extensively: to auto-grant subsequent dangerous permissions and dismiss system dialogs (`catAllViewSwitch`), to steal on-screen UI elements and keystrokes, and to render phishing overlays -- including fake system-update screens, fake full-screen lock screens, a generic remote-URL full-screen WebView loader (`transparent`, used to push arbitrary attacker-hosted phishing pages), and transparent touch-capturing overlays -- on top of the 349 targeted financial apps. A dedicated PIN-theft subsystem (targeting 140+ banking/crypto apps) places an invisible overlay over the banking keypad to record taps, with the C2-updatable `replacePinTargets`/`addPinTargets` commands letting operators retarget apps without shipping a new build.

The most significant new capability is a fully automated wireless-ADB privilege-escalation chain, described by Zimperium as "an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices." Using Accessibility, the malware opens Settings > About Phone, queries the accessibility node tree for the "Build number" row, and simulates seven rapid taps to unlock Developer Options; it then fires an `APPLICATION_DEVELOPMENT_SETTINGS` intent, locates and toggles "Wireless debugging" on, opens "Pair device with pairing code," and polls the resulting modal's accessibility layout to scrape the 6-digit SPAKE2 pairing code and dynamic port. It instantiates a local SPAKE2 pairing handler, opens a TLS-encrypted channel to the ADB daemon on 127.0.0.1, completes the SPAKE2 key exchange with the scraped code, and trades peer-identity metadata to finish pairing -- yielding authenticated shell-level access that bypasses Android's normal runtime consent prompts, without physical device contact or user awareness. This shell access is combined with Device Administrator API abuse: `admSet` fires an `android.app.action.ADD_DEVICE_ADMIN` intent under the social-engineering lure "System service requires administrator privileges," and once granted, `admPwd` calls `DevicePolicyManager.resetPassword()` to force-reset or overwrite the device's lock-screen PIN/password -- giving operators both remote-shell and lock-screen-takeover capability. Persistence is maintained via a `ForegroundKeepAlive` service and an OEM-aware `autoBoot` command that queries `Build.MANUFACTURER` and dispatches vendor-specific Intents (Xiaomi MIUI Security Center, Samsung Smart Manager, and proprietary OPPO/Vivo/Huawei mechanisms) to bypass aggressive battery/power management; the app can also hide its own launcher icon (`hideMyMainActivity`, `iconAlias`) to evade manual removal.

C2 communication uses an HTTPS handshake that upgrades to a persistent WebSocket channel, with traffic encrypted using AES in ECB mode under an embedded static key, connecting to an updated "v2"-branded control panel. Distribution has shifted from earlier delivery methods to Amazon AWS-hosted S3 buckets across multiple regions (ap-south-1, mx-central-1, ap-southeast-1), a Telegram-Bot-API-hosted APK (observed via at least two distinct bot tokens), and a fake-Google-Play lookalike domain (googleplaydown.com) serving unique per-victim lure paths. Zimperium published the full 167-command reference and an IOC set (APK/dropper SHA-256 hashes, C2 domains, and distribution URLs, spanning roughly 120 payload samples and 60 dropper samples) to a public GitHub repository alongside the blog post.

MITRE ATT&CK techniques used in TL-2026-2128

Defense Evasion

T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1628.001 Hide Artifacts: Suppress Application Icon; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1418 Software Discovery

Command and Control

T1437 Application Layer Protocol; T1521 Encrypted Channel

Collection

T1512 Video Capture; T1513 Screen Capture; T1533 Data from Local System; T1636.003 Protected User Data: Contact List; T1636.004 Protected User Data: SMS Messages

defense-evasion

T1516 Input Injection; T1629.002 Impair Defenses: Device Lockout

Persistence

T1541 Foreground Persistence

Privilege Escalation

T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions

Initial Access

T1660 Phishing

Affected products and versions in ToxicPanda 2.0 Android Banking Trojan Expands to 349

  • Google — Android OS
    Vulnerable versions: Android devices with Accessibility Service and (for wireless-ADB abuse) Android 11+ Wireless Debugging support
  • Multiple — Banking, e-wallet, and cryptocurrency mobile applications (349 targeted apps across 16 countries; 140+ specifically targeted for PIN theft)
    Vulnerable versions: N/A - targeted via device-level overlay/accessibility abuse rather than an application vulnerability

Remediation for ToxicPanda 2.0 Android Banking Trojan Expands to 349

Immediate actions

  • Block the identified ToxicPanda 2.0 C2 domains (cctvv2.com, www.v17001.com, www.w17907.com, g8688808.com) and AWS S3 dropper URLs at DNS/proxy/firewall layers
  • Restrict or alert on APK installation originating from AWS S3 links, Telegram bot file hosts, and unofficial 'Google Play' lookalike domains such as googleplaydown.com
  • Audit installed Android apps with recently-granted Accessibility Service or Device Administrator privileges on managed and BYOD fleets, and revoke unrecognized grants

Workarounds

  • Do not sideload APKs from links shared via SMS, Telegram, or third-party cloud storage (AWS S3) outside the official Google Play Store
  • Disable Wireless Debugging and Developer Options on personal and corporate Android devices unless actively required

Longer-term hardening

  • Deploy mobile threat defense (MTD) tooling with behavioral detection for AccessibilityService abuse chains, unattended Wireless-Debugging enablement, and rapid Developer-Options toggling
  • Enforce MDM policy disabling USB/Wireless ADB debugging and Developer Options on corporate-managed Android devices
  • Work with banking-app vendors to add overlay/screen-reader-permission anomaly detection (RASP) to detect ToxicPanda-style transparent-overlay PIN capture

Timeline of ToxicPanda 2.0 Android Banking Trojan Expands to 349

  • Cleafy Labs publicly discloses the original ToxicPanda Android banking trojan, reporting a botnet of 1,500+ infected devices concentrated in Italy (56.8%) and Portugal (18.7%) and targeting 16 banking apps across Italy, Portugal, Spain, France, Peru, Hong Kong, and the UK, delivered via icon-mimicry side-loading (fake Chrome/VISA/dating apps) and linked to the TgToxic malware family via 61 shared commands and Chinese-language/DNS artifacts.
  • Zimperium publishes the ToxicPanda 2.0 IOC set -- C2 domains, ~120 payload and ~60 dropper SHA-256 hashes, AWS S3/Telegram distribution URLs, and the full 167-command reference -- to its public GitHub IOC repository (2026-08-ToxicPanda).
  • Zimperium zLabs publishes analysis of ToxicPanda 2.0, documenting expansion to 349 targeted financial institutions across 16 countries, 167 remote commands, and new wireless-ADB-debugging plus Device Administrator abuse techniques.
  • SecurityWeek reports ToxicPanda 2.0's 16-country target list by name for the first time, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama, and quotes Zimperium's description of the wireless-ADB abuse as an 'automated click-based mechanism.'
  • The Hacker News reports, citing Zimperium, that ToxicPanda has reportedly been active since approximately July 2022 -- predating its first public documentation by over two years -- and covers ToxicPanda 2.0 alongside the separate, unrelated GoldDigger/GoldFactory Android banking-malware campaign in the same roundup.
  • The Hacker News, SecurityWeek, cybersecuritynews.com, SC Media, and Infosecurity Magazine publish coverage of ToxicPanda 2.0's expanded targeting, wireless-ADB privilege escalation, and AWS-hosted distribution infrastructure.
  • Threadlinqs Intelligence Platform completes RESEARCH-phase documentation of ToxicPanda 2.0 as TL-2026-2128.
  • Threadlinqs Intelligence Platform HUNT phase identifies and grounds the ToxicPanda 2.0 campaign from the verified Zimperium primary source after an assigned Dark Reading source URL returned HTTP 403.

Sources cited for ToxicPanda 2.0 Android Banking Trojan Expands to 349

Threats related to ToxicPanda 2.0 Android Banking Trojan Expands to 349

Detection coverage for TL-2026-2128

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2128 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2128

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats