Skip to navigation

Threat reportMalwareTL-2026-2128

ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

highACTIVE

ToxicPanda, an Android banking trojan first disclosed by Cleafy in late 2024 targeting Europe and Latin America, has matured into version 2.0 with 167 remote commands and phishing-overlay coverage of 349 banking, e-wallet, and cryptocurrency applications across 16 countries. Zimperium zLabs documents new privilege-escalation techniques abusing wireless ADB debugging, Android Accessibility Service, and the Device Administrator API, with samples now distributed via Amazon AWS-hosted S3 buckets and Telegram bot hosting.

Key facts for ToxicPanda 2.0 wireless ADB hijacking

IdentifiersTL-2026-2128
Also known asToxicPanda v2
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsGoogle Android OS; Multiple Banking, e-wallet, and cryptocurrency mobile applications (349 targeted apps across 16 countries; 140+ specifically targeted for PIN theft)
Nation-state nexusChina
MalwareTgToxic, ToxicPanda
ToolsToxicPanda v2 WebSocket C2 panel
MITRE ATT&CK techniquesT1406 Obfuscated Files or Information, T1407 Download New Code at Runtime, T1417.001 Input Capture: Keylogging, T1417.002 Input Capture: GUI Input Capture, T1418 Software Discovery, T1437 Application Layer Protocol, T1453 Abuse Accessibility Features, T1512 Video Capture, T1513 Screen Capture, T1516 Input Injection, T1521 Encrypted Channel, T1533 Data from Local System and 8 more in the attack flow
MotivationFINANCIAL
Target sectorsbanking, financial services, e-wallet digital payments, cryptocurrency
Target regionspakistan, south africa, mexico, nigeria, india, indonesia, panama, italy, portugal, spain, france, germany
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for ToxicPanda 2.0 wireless ADB hijacking

As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2128 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains

Detects repeated outbound connections and WebSocket-upgrade traffic to ToxicPanda 2.0's dedicated 'v2' C2 panel domains (cctvv2.com, v17001.com, w17907.com, g8688808.com). These domains are not shared/CDN-fronted infrastructure, so any contact is high-confidence evidence of an active C2 channel carrying AES-ECB-encrypted PIN, SMS, contact-list, keystroke, and screen/photo exfiltration traffic from a compromised device.

Splunk SPL

index=network OR index=proxy sourcetype=firewall OR sourcetype=proxy OR sourcetype=stream:tcp
| eval matched_c2=case(
    match(dest_domain,"(?i)^(cctvv2\.com|www\.v17001\.com|v17001\.com|www\.w17907\.com|w17907\.com|g8688808\.com)$"), "known-toxicpanda-c2-domain",
    match(uri_path,"(?i)^/panel") AND match(dest_domain,"(?i)cctvv2\.com|v17001\.com|w17907\.com"), "toxicpanda-panel-path",
    1=0, "none")
| eval is_websocket_upgrade=if(match(http_upgrade,"(?i)websocket") OR match(connection_header,"(?i)upgrade"),1,0)
| where matched_c2!="none"
| bin _time span=5m
| stats count as beacon_count values(uri_path) as paths dc(_time) as active_windows values(is_websocket_upgrade) as ws_upgrade_flags by src_ip, dest_domain
| where beacon_count>=10 AND active_windows>=3
| eval verdict="possible-toxicpanda-websocket-c2-beacon"
| sort -beacon_count

Microsoft KQL

let ToxicPandaC2 = dynamic(["cctvv2.com","v17001.com","w17907.com","g8688808.com"]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any (ToxicPandaC2)
| summarize BeaconCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), DistinctPorts=dcount(RemotePort) by DeviceName, RemoteUrl, InitiatingProcessFileName
| where BeaconCount >= 10
| project DeviceName, RemoteUrl, BeaconCount, DistinctPorts, FirstSeen, LastSeen
| order by BeaconCount desc

Sigma

title: ToxicPanda 2.0 WebSocket C2 Beacon to Known Panel Domains
id: 4e6a8d1c-2b5f-4c9a-a1d3-7f2c9e0b1d03
status: experimental
description: Detects outbound HTTPS-to-WebSocket-upgrade traffic and repeated connections to ToxicPanda 2.0's known 'v2' C2 panel domains, indicating an active command-and-control channel and possible PIN/credential/SMS/contact/screen exfiltration.
references:
    - https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile
    - https://github.com/Zimperium/IOC/tree/master/2026-08-ToxicPanda
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.command-and-control
    - attack.t1437
    - attack.t1521
    - attack.credential-access
    - attack.t1417.001
    - attack.t1417.002
    - attack.collection
    - attack.t1512
    - attack.t1513
    - attack.t1533
    - attack.t1636.003
    - attack.t1636.004
    - attack.execution
    - attack.t1516
logsource:
    category: proxy
    product: network
detection:
    selection_domain:
        dst_domain:
            - 'cctvv2.com'
            - 'v17001.com'
            - 'www.v17001.com'
            - 'w17907.com'
            - 'www.w17907.com'
            - 'g8688808.com'
    selection_panel_path:
        url|contains: '/panel'
    condition: selection_domain or selection_panel_path
falsepositives:
    - Unlikely; these are dedicated, non-shared C2 domains observed only in ToxicPanda 2.0 infrastructure
level: critical

Known false positives:

  • None expected under normal conditions since these are dedicated, non-shared attacker domains; false positives would most likely arise from DNS sinkhole/security-scanner traffic intentionally contacting the IOC set

Tuning notes: Lower beacon_count/active_windows thresholds for low-traffic mobile-only network segments (e.g. corporate Wi-Fi serving BYOD devices) where 10 hits/5-min windows over 24h may be too strict; raise thresholds if the environment has any legitimate WebSocket-based services that could coincidentally traverse a shared egress proxy alongside C2 traffic.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain · unlock with TL Creds
  • ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain · unlock with TL Creds
  • ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains · unlock with TL Creds
  • ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain · unlock with TL Creds
  • ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain · unlock with TL Creds
  • ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains · unlock with TL Creds
  • ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain · unlock with TL Creds
  • ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain · unlock with TL Creds

Indicators of compromise for ToxicPanda 2.0 wireless ADB hijacking

As of 2026-08-24, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2128.

Sample indicators (3 of 24)

  • Domain: cctvv2[.]com
  • URL: hxxps://xcmtxc1oam1[.]s3[.]ap-south-1[.]amazonaws[.]com
  • File hash: 3c76887d942a2a1c02455070887e14015ea9fe63fc9e4777bfbc633ba29601d5

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for ToxicPanda 2.0 wireless ADB hijacking

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How ToxicPanda 2.0 wireless ADB hijacking works

ToxicPanda 2.0 is a major capability escalation of the ToxicPanda Android banking trojan. Later reporting (The Hacker News, citing Zimperium) places the family's activity as far back as approximately July 2022, but it was first publicly documented by Cleafy Labs in November 2024 as a Southeast-Asia-origin family -- sharing 61 commands with the TgToxic trojan, and carrying artifacts pointing to Chinese-speaking operators, including a hardcoded reference to the Chinese 114DNS resolver (114.114.114.114) and embedded Chinese-language strings. That original wave infected over 1,500 Android devices across 16 banking apps, delivered via social-engineered side-loading using icons that mimicked Chrome, VISA, and dating apps, and concentrated in Italy (56.8% of infections), Portugal (18.7%), Hong Kong (4.6%), with further activity in Spain, Peru, France, Germany, and the UK; it used three hardcoded C2 domains (dksu[.]top, mixcom[.]one, freebasic[.]cn) and a static AES-ECB key, and already supported on-device-fraud (ODF) account takeover, OTP interception, and photo-album exfiltration.

Zimperium zLabs' August 2026 analysis shows the operators have since rebuilt the malware into a 167-command remote-access platform with fake phishing overlays covering 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, with reporting naming Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama among the targeted markets.

The infection chain begins with a dropper that requests VPN service privileges (to block Google Play Protect communication) and presents a fake WebView-based installation interface before decrypting and installing the main payload from the app's assets folder. On first run the payload requests Accessibility Service permission, enumerates the device's installed applications, and transmits their package names and icons to the C2 as part of registration. It then abuses Accessibility extensively: to auto-grant subsequent dangerous permissions and dismiss system dialogs (`catAllViewSwitch`), to steal on-screen UI elements and keystrokes, and to render phishing overlays -- including fake system-update screens, fake full-screen lock screens, a generic remote-URL full-screen WebView loader (`transparent`, used to push arbitrary attacker-hosted phishing pages), and transparent touch-capturing overlays -- on top of the 349 targeted financial apps. A dedicated PIN-theft subsystem (targeting 140+ banking/crypto apps) places an invisible overlay over the banking keypad to record taps, with the C2-updatable `replacePinTargets`/`addPinTargets` commands letting operators retarget apps without shipping a new build.

The most significant new capability is a fully automated wireless-ADB privilege-escalation chain, described by Zimperium as "an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices." Using Accessibility, the malware opens Settings > About Phone, queries the accessibility node tree for the "Build number" row, and simulates seven rapid taps to unlock Developer Options; it then fires an `APPLICATION_DEVELOPMENT_SETTINGS` intent, locates and toggles "Wireless debugging" on, opens "Pair device with pairing code," and polls the resulting modal's accessibility layout to scrape the 6-digit SPAKE2 pairing code and dynamic port. It instantiates a local SPAKE2 pairing handler, opens a TLS-encrypted channel to the ADB daemon on 127.0.0.1, completes the SPAKE2 key exchange with the scraped code, and trades peer-identity metadata to finish pairing -- yielding authenticated shell-level access that bypasses Android's normal runtime consent prompts, without physical device contact or user awareness. This shell access is combined with Device Administrator API abuse: `admSet` fires an `android.app.action.ADD_DEVICE_ADMIN` intent under the social-engineering lure "System service requires administrator privileges," and once granted, `admPwd` calls `DevicePolicyManager.resetPassword()` to force-reset or overwrite the device's lock-screen PIN/password -- giving operators both remote-shell and lock-screen-takeover capability. Persistence is maintained via a `ForegroundKeepAlive` service and an OEM-aware `autoBoot` command that queries `Build.MANUFACTURER` and dispatches vendor-specific Intents (Xiaomi MIUI Security Center, Samsung Smart Manager, and proprietary OPPO/Vivo/Huawei mechanisms) to bypass aggressive battery/power management; the app can also hide its own launcher icon (`hideMyMainActivity`, `iconAlias`) to evade manual removal.

C2 communication uses an HTTPS handshake that upgrades to a persistent WebSocket channel, with traffic encrypted using AES in ECB mode under an embedded static key, connecting to an updated "v2"-branded control panel. Distribution has shifted from earlier delivery methods to Amazon AWS-hosted S3 buckets across multiple regions (ap-south-1, mx-central-1, ap-southeast-1), a Telegram-Bot-API-hosted APK (observed via at least two distinct bot tokens), and a fake-Google-Play lookalike domain (googleplaydown.com) serving unique per-victim lure paths. Zimperium published the full 167-command reference and an IOC set (APK/dropper SHA-256 hashes, C2 domains, and distribution URLs, spanning roughly 120 payload samples and 60 dropper samples) to a public GitHub repository alongside the blog post.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1628.001 Hide Artifacts: Suppress Application Icon; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1418 Software Discovery

Command and Control

T1437 Application Layer Protocol; T1521 Encrypted Channel

Collection

T1512 Video Capture; T1513 Screen Capture; T1533 Data from Local System; T1636.003 Protected User Data: Contact List; T1636.004 Protected User Data: SMS Messages

defense-evasion

T1516 Input Injection; T1629.002 Impair Defenses: Device Lockout

Persistence

T1541 Foreground Persistence

Privilege Escalation

T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions

Initial Access

T1660 Phishing

Remediation for ToxicPanda 2.0 wireless ADB hijacking

Immediate actions

  • Block the identified ToxicPanda 2.0 C2 domains (cctvv2.com, www.v17001.com, www.w17907.com, g8688808.com) and AWS S3 dropper URLs at DNS/proxy/firewall layers
  • Restrict or alert on APK installation originating from AWS S3 links, Telegram bot file hosts, and unofficial 'Google Play' lookalike domains such as googleplaydown.com
  • Audit installed Android apps with recently-granted Accessibility Service or Device Administrator privileges on managed and BYOD fleets, and revoke unrecognized grants

Workarounds

  • Do not sideload APKs from links shared via SMS, Telegram, or third-party cloud storage (AWS S3) outside the official Google Play Store
  • Disable Wireless Debugging and Developer Options on personal and corporate Android devices unless actively required

Longer-term hardening

  • Deploy mobile threat defense (MTD) tooling with behavioral detection for AccessibilityService abuse chains, unattended Wireless-Debugging enablement, and rapid Developer-Options toggling
  • Enforce MDM policy disabling USB/Wireless ADB debugging and Developer Options on corporate-managed Android devices
  • Work with banking-app vendors to add overlay/screen-reader-permission anomaly detection (RASP) to detect ToxicPanda-style transparent-overlay PIN capture

Affected and fixed versions

  • Google — Android OS
    Vulnerable versions: Android devices with Accessibility Service and (for wireless-ADB abuse) Android 11+ Wireless Debugging support
  • Multiple — Banking, e-wallet, and cryptocurrency mobile applications (349 targeted apps across 16 countries; 140+ specifically targeted for PIN theft)
    Vulnerable versions: N/A - targeted via device-level overlay/accessibility abuse rather than an application vulnerability

Timeline of ToxicPanda 2.0 wireless ADB hijacking

  • Cleafy Labs publicly discloses the original locked-ioc-23 Android banking trojan, reporting a botnet of 1,500+ infected devices concentrated in Italy (56.8%) and Portugal (18.7%) and targeting 16 banking apps across Italy, Portugal, Spain, France, Peru, Hong Kong, and the UK, delivered via icon-mimicry side-loading (fake Chrome/VISA/dating apps) and linked to the locked-ioc-24 malware family via 61 shared commands and Chinese-language/DNS artifacts.
  • Zimperium publishes the locked-ioc-23 2.0 IOC set -- C2 domains, ~120 payload and ~60 dropper SHA-256 hashes, AWS S3/Telegram distribution URLs, and the full 167-command reference -- to its public GitHub IOC repository (2026-08-ToxicPanda).
  • Zimperium zLabs publishes analysis of locked-ioc-23 2.0, documenting expansion to 349 targeted financial institutions across 16 countries, 167 remote commands, and new wireless-ADB-debugging plus Device Administrator abuse techniques.
  • SecurityWeek reports locked-ioc-23 2.0's 16-country target list by name for the first time, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama, and quotes Zimperium's description of the wireless-ADB abuse as an 'automated click-based mechanism.'
  • The Hacker News reports, citing Zimperium, that locked-ioc-23 has reportedly been active since approximately July 2022 -- predating its first public documentation by over two years -- and covers locked-ioc-23 2.0 alongside the separate, unrelated GoldDigger/GoldFactory Android banking-malware campaign in the same roundup.
  • The Hacker News, SecurityWeek, cybersecuritynews.com, SC Media, and Infosecurity Magazine publish coverage of locked-ioc-23 2.0's expanded targeting, wireless-ADB privilege escalation, and AWS-hosted distribution infrastructure.
  • Threadlinqs Intelligence Platform completes RESEARCH-phase documentation of locked-ioc-23 2.0 as TL-2026-2128.
  • Threadlinqs Intelligence Platform HUNT phase identifies and grounds the locked-ioc-23 2.0 campaign from the verified Zimperium primary source after an assigned Dark Reading source URL returned HTTP 403.

Sources cited for ToxicPanda 2.0 wireless ADB hijacking

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats