# ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

> ToxicPanda, an Android banking trojan first disclosed by Cleafy in late 2024 targeting Europe and Latin America, has matured into version 2.0 with 167 remote commands and phishing-overlay coverage of 349 banking, e-wallet, and cryptocurrency applications across 16 countries. Zimperium zLabs documents new privilege-escalation techniques abusing wireless ADB debugging, Android Accessibility Service, and the Device Administrator API, with samples now distributed via Amazon AWS-hosted S3 buckets and Telegram bot hosting.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2128
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-toxicpanda-2-0-wireless-adb-hijacking-tl-2026-2128.webp?v=13ce826e (Threadlinqs threat intel: ToxicPanda 2.0 Targets 349 Institutions: Detection & IOCs (TL-2026-2128) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2128
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

ToxicPanda 2.0 is a major capability escalation of the ToxicPanda Android banking trojan. Later reporting (The Hacker News, citing Zimperium) places the family's activity as far back as approximately July 2022, but it was first publicly documented by Cleafy Labs in November 2024 as a Southeast-Asia-origin family -- sharing 61 commands with the TgToxic trojan, and carrying artifacts pointing to Chinese-speaking operators, including a hardcoded reference to the Chinese 114DNS resolver (114.114.114.114) and embedded Chinese-language strings. That original wave infected over 1,500 Android devices across 16 banking apps, delivered via social-engineered side-loading using icons that mimicked Chrome, VISA, and dating apps, and concentrated in Italy (56.8% of infections), Portugal (18.7%), Hong Kong (4.6%), with further activity in Spain, Peru, France, Germany, and the UK; it used three hardcoded C2 domains (dksu[.]top, mixcom[.]one, freebasic[.]cn) and a static AES-ECB key, and already supported on-device-fraud (ODF) account takeover, OTP interception, and photo-album exfiltration.

Zimperium zLabs' August 2026 analysis shows the operators have since rebuilt the malware into a 167-command remote-access platform with fake phishing overlays covering 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, with reporting naming Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama among the targeted markets.

The infection chain begins with a dropper that requests VPN service privileges (to block Google Play Protect communication) and presents a fake WebView-based installation interface before decrypting and installing the main payload from the app's assets folder. On first run the payload requests Accessibility Service permission, enumerates the device's installed applications, and transmits their package names and icons to the C2 as part of registration. It then abuses Accessibility extensively: to auto-grant subsequent dangerous permissions and dismiss system dialogs (`catAllViewSwitch`), to steal on-screen UI elements and keystrokes, and to render phishing overlays -- including fake system-update screens, fake full-screen lock screens, a generic remote-URL full-screen WebView loader (`transparent`, used to push arbitrary attacker-hosted phishing pages), and transparent touch-capturing overlays -- on top of the 349 targeted financial apps. A dedicated PIN-theft subsystem (targeting 140+ banking/crypto apps) places an invisible overlay over the banking keypad to record taps, with the C2-updatable `replacePinTargets`/`addPinTargets` commands letting operators retarget apps without shipping a new build.

The most significant new capability is a fully automated wireless-ADB privilege-escalation chain, described by Zimperium as "an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices." Using Accessibility, the malware opens Settings > About Phone, queries the accessibility node tree for the "Build number" row, and simulates seven rapid taps to unlock Developer Options; it then fires an `APPLICATION_DEVELOPMENT_SETTINGS` intent, locates and toggles "Wireless debugging" on, opens "Pair device with pairing code," and polls the resulting modal's accessibility layout to scrape the 6-digit SPAKE2 pairing code and dynamic port. It instantiates a local SPAKE2 pairing handler, opens a TLS-encrypted channel to the ADB daemon on 127.0.0.1, completes the SPAKE2 key exchange with the scraped code, and trades peer-identity metadata to finish pairing -- yielding authenticated shell-level access that bypasses Android's normal runtime consent prompts, without physical device contact or user awareness. This shell access is combined with Device Administrator API abuse: `admSet` fires an `android.app.action.ADD_DEVICE_ADMIN` intent under the social-engineering lure "System service requires administrator privileges," and once granted, `admPwd` calls `DevicePolicyManager.resetPassword()` to force-reset or overwrite the device's lock-screen PIN/password -- giving operators both remote-shell and lock-screen-takeover capability. Persistence is maintained via a `ForegroundKeepAlive` service and an OEM-aware `autoBoot` command that queries `Build.MANUFACTURER` and dispatches vendor-specific Intents (Xiaomi MIUI Security Center, Samsung Smart Manager, and proprietary OPPO/Vivo/Huawei mechanisms) to bypass aggressive battery/power management; the app can also hide its own launcher icon (`hideMyMainActivity`, `iconAlias`) to evade manual removal.

C2 communication uses an HTTPS handshake that upgrades to a persistent WebSocket channel, with traffic encrypted using AES in ECB mode under an embedded static key, connecting to an updated "v2"-branded control panel. Distribution has shifted from earlier delivery methods to Amazon AWS-hosted S3 buckets across multiple regions (ap-south-1, mx-central-1, ap-southeast-1), a Telegram-Bot-API-hosted APK (observed via at least two distinct bot tokens), and a fake-Google-Play lookalike domain (googleplaydown.com) serving unique per-victim lure paths. Zimperium published the full 167-command reference and an IOC set (APK/dropper SHA-256 hashes, C2 domains, and distribution URLs, spanning roughly 120 payload samples and 60 dropper samples) to a public GitHub repository alongside the blog post.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1407 Download New Code at Runtime
- T1406 Obfuscated Files or Information
- T1628.001 Hide Artifacts: Suppress Application Icon
- T1541 Foreground Persistence
- T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions
- T1453 Abuse Accessibility Features
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1516 Input Injection
- T1629.002 Impair Defenses: Device Lockout
- T1418 Software Discovery
- T1636.003 Protected User Data: Contact List
- T1636.004 Protected User Data: SMS Messages
- T1533 Data from Local System
- T1512 Video Capture
- T1513 Screen Capture
- T1437 Application Layer Protocol
- T1521 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains** (`TL-2026-2128-SPL-003`)

Detects repeated outbound connections and WebSocket-upgrade traffic to ToxicPanda 2.0's dedicated 'v2' C2 panel domains (cctvv2.com, v17001.com, w17907.com, g8688808.com). These domains are not shared/CDN-fronted infrastructure, so any contact is high-confidence evidence of an active C2 channel carrying AES-ECB-encrypted PIN, SMS, contact-list, keystroke, and screen/photo exfiltration traffic from a compromised device.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1437, T1521, T1417.001, T1417.002, T1516, T1636.003, T1636.004, T1533, T1512, T1513
- **Data sources:** network_firewall_logs, proxy_logs, dns_logs, mobile_threat_defense_network_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network OR index=proxy sourcetype=firewall OR sourcetype=proxy OR sourcetype=stream:tcp
| eval matched_c2=case(
    match(dest_domain,"(?i)^(cctvv2\.com|www\.v17001\.com|v17001\.com|www\.w17907\.com|w17907\.com|g8688808\.com)$"), "known-toxicpanda-c2-domain",
    match(uri_path,"(?i)^/panel") AND match(dest_domain,"(?i)cctvv2\.com|v17001\.com|w17907\.com"), "toxicpanda-panel-path",
    1=0, "none")
| eval is_websocket_upgrade=if(match(http_upgrade,"(?i)websocket") OR match(connection_header,"(?i)upgrade"),1,0)
| where matched_c2!="none"
| bin _time span=5m
| stats count as beacon_count values(uri_path) as paths dc(_time) as active_windows values(is_websocket_upgrade) as ws_upgrade_flags by src_ip, dest_domain
| where beacon_count>=10 AND active_windows>=3
| eval verdict="possible-toxicpanda-websocket-c2-beacon"
| sort -beacon_count
```

### Microsoft KQL

```kql
let ToxicPandaC2 = dynamic(["cctvv2.com","v17001.com","w17907.com","g8688808.com"]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any (ToxicPandaC2)
| summarize BeaconCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), DistinctPorts=dcount(RemotePort) by DeviceName, RemoteUrl, InitiatingProcessFileName
| where BeaconCount >= 10
| project DeviceName, RemoteUrl, BeaconCount, DistinctPorts, FirstSeen, LastSeen
| order by BeaconCount desc
```

### Sigma

```yaml
title: ToxicPanda 2.0 WebSocket C2 Beacon to Known Panel Domains
id: 4e6a8d1c-2b5f-4c9a-a1d3-7f2c9e0b1d03
status: experimental
description: Detects outbound HTTPS-to-WebSocket-upgrade traffic and repeated connections to ToxicPanda 2.0's known 'v2' C2 panel domains, indicating an active command-and-control channel and possible PIN/credential/SMS/contact/screen exfiltration.
references:
    - https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile
    - https://github.com/Zimperium/IOC/tree/master/2026-08-ToxicPanda
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.command-and-control
    - attack.t1437
    - attack.t1521
    - attack.credential-access
    - attack.t1417.001
    - attack.t1417.002
    - attack.collection
    - attack.t1512
    - attack.t1513
    - attack.t1533
    - attack.t1636.003
    - attack.t1636.004
    - attack.execution
    - attack.t1516
logsource:
    category: proxy
    product: network
detection:
    selection_domain:
        dst_domain:
            - 'cctvv2.com'
            - 'v17001.com'
            - 'www.v17001.com'
            - 'w17907.com'
            - 'www.w17907.com'
            - 'g8688808.com'
    selection_panel_path:
        url|contains: '/panel'
    condition: selection_domain or selection_panel_path
falsepositives:
    - Unlikely; these are dedicated, non-shared C2 domains observed only in ToxicPanda 2.0 infrastructure
level: critical
```

**Known false positives:**

- None expected under normal conditions since these are dedicated, non-shared attacker domains; false positives would most likely arise from DNS sinkhole/security-scanner traffic intentionally contacting the IOC set

**Tuning notes:** Lower beacon_count/active_windows thresholds for low-traffic mobile-only network segments (e.g. corporate Wi-Fi serving BYOD devices) where 10 hits/5-min windows over 24h may be too strict; raise thresholds if the environment has any legitimate WebSocket-based services that could coincidentally traverse a shared egress proxy alongside C2 traffic.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain (locked: unlock with TL Creds)
- ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain (locked: unlock with TL Creds)
- ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains (locked: unlock with TL Creds)
- ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain (locked: unlock with TL Creds)
- ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain (locked: unlock with TL Creds)
- ToxicPanda 2.0 WebSocket C2 Beacon to Known 'v2' Panel Domains (locked: unlock with TL Creds)
- ToxicPanda 2.0 Dropper Delivery via AWS S3, Telegram Bot API, or Fake Google Play Domain (locked: unlock with TL Creds)
- ToxicPanda 2.0 Rapid Accessibility-to-Wireless-ADB Privilege Escalation Chain (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- Domain: `cctvv2[.]com`
- URL: `hxxps://xcmtxc1oam1[.]s3[.]ap-south-1[.]amazonaws[.]com`
- File hash: `3c76887d942a2a1c02455070887e14015ea9fe63fc9e4777bfbc633ba29601d5`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile](https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile)
- [Zimperium IOC Repository: 2026-08-ToxicPanda](https://github.com/Zimperium/IOC/tree/master/2026-08-ToxicPanda)
- [ToxicPanda: a new banking trojan from Asia hit Europe and LATAM](https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam)
- [ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud](https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html)
- [ToxicPanda Android Malware Can Steal Banking PINs and Gain Shell Access to Phones](https://cybersecuritynews.com/toxicpanda-android-malware/)
- [New Android banking Trojan ToxicPanda 2.0 expands victim targeting](https://www.scworld.com/brief/new-android-banking-trojan-toxicpanda-2-0-expands-victim-targeting)
- [Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight](https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/)
- [Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps](https://www.infosecurity-magazine.com/news/updated-toxicpanda-140-banking/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2128