# ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

> ToxicPanda, an Android banking trojan first disclosed by Cleafy in late 2024 targeting Europe and Latin America, has matured into version 2.0 with 167 remote commands and phishing-overlay coverage of 349 banking, e-wallet, and cryptocurrency applications across 16 countries. Zimperium zLabs documents new privilege-escalation techniques abusing wireless ADB debugging, Android Accessibility Service, and the Device Administrator API, with samples now distributed via Amazon AWS-hosted S3 buckets and Telegram bot hosting.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2128
- **ID:** TL-2026-2128
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ToxicPanda 2.0 is a major capability escalation of the ToxicPanda Android banking trojan. Later reporting (The Hacker News, citing Zimperium) places the family's activity as far back as approximately July 2022, but it was first publicly documented by Cleafy Labs in November 2024 as a Southeast-Asia-origin family -- sharing 61 commands with the TgToxic trojan, and carrying artifacts pointing to Chinese-speaking operators, including a hardcoded reference to the Chinese 114DNS resolver (114.114.114.114) and embedded Chinese-language strings. That original wave infected over 1,500 Android devices across 16 banking apps, delivered via social-engineered side-loading using icons that mimicked Chrome, VISA, and dating apps, and concentrated in Italy (56.8% of infections), Portugal (18.7%), Hong Kong (4.6%), with further activity in Spain, Peru, France, Germany, and the UK; it used three hardcoded C2 domains (dksu[.]top, mixcom[.]one, freebasic[.]cn) and a static AES-ECB key, and already supported on-device-fraud (ODF) account takeover, OTP interception, and photo-album exfiltration.

Zimperium zLabs' August 2026 analysis shows the operators have since rebuilt the malware into a 167-command remote-access platform with fake phishing overlays covering 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, with reporting naming Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama among the targeted markets.

The infection chain begins with a dropper that requests VPN service privileges (to block Google Play Protect communication) and presents a fake WebView-based installation interface before decrypting and installing the main payload from the app's assets folder. On first run the payload requests Accessibility Service permission, enumerates the device's installed applications, and transmits their package names and icons to the C2 as part of registration. It then abuses Accessibility extensively: to auto-grant subsequent dangerous permissions and dismiss system dialogs (`catAllViewSwitch`), to steal on-screen UI elements and keystrokes, and to render phishing overlays -- including fake system-update screens, fake full-screen lock screens, a generic remote-URL full-screen WebView loader (`transparent`, used to push arbitrary attacker-hosted phishing pages), and transparent touch-capturing overlays -- on top of the 349 targeted financial apps. A dedicated PIN-theft subsystem (targeting 140+ banking/crypto apps) places an invisible overlay over the banking keypad to record taps, with the C2-updatable `replacePinTargets`/`addPinTargets` commands letting operators retarget apps without shipping a new build.

The most significant new capability is a fully automated wireless-ADB privilege-escalation chain, described by Zimperium as "an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices." Using Accessibility, the malware opens Settings > About Phone, queries the accessibility node tree for the "Build number" row, and simulates seven rapid taps to unlock Developer Options; it then fires an `APPLICATION_DEVELOPMENT_SETTINGS` intent, locates and toggles "Wireless debugging" on, opens "Pair device with pairing code," and polls the resulting modal's accessibility layout to scrape the 6-digit SPAKE2 pairing code and dynamic port. It instantiates a local SPAKE2 pairing handler, opens a TLS-encrypted channel to the ADB daemon on 127.0.0.1, completes the SPAKE2 key exchange with the scraped code, and trades peer-identity metadata to finish pairing -- yielding authenticated shell-level access that bypasses Android's normal runtime consent prompts, without physical device contact or user awareness. This shell access is combined with Device Administrator API abuse: `admSet` fires an `android.app.action.ADD_DEVICE_ADMIN` intent under the social-engineering lure "System service requires administrator privileges," and once granted, `admPwd` calls `DevicePolicyManager.resetPassword()` to force-reset or overwrite the device's lock-screen PIN/password -- giving operators both remote-shell and lock-screen-takeover capability. Persistence is maintained via a `ForegroundKeepAlive` service and an OEM-aware `autoBoot` command that queries `Build.MANUFACTURER` and dispatches vendor-specific Intents (Xiaomi MIUI Security Center, Samsung Smart Manager, and proprietary OPPO/Vivo/Huawei mechanisms) to bypass aggressive battery/power management; the app can also hide its own launcher icon (`hideMyMainActivity`, `iconAlias`) to evade manual removal.

C2 communication uses an HTTPS handshake that upgrades to a persistent WebSocket channel, with traffic encrypted using AES in ECB mode under an embedded static key, connecting to an updated "v2"-branded control panel. Distribution has shifted from earlier delivery methods to Amazon AWS-hosted S3 buckets across multiple regions (ap-south-1, mx-central-1, ap-southeast-1), a Telegram-Bot-API-hosted APK (observed via at least two distinct bot tokens), and a fake-Google-Play lookalike domain (googleplaydown.com) serving unique per-victim lure paths. Zimperium published the full 167-command reference and an IOC set (APK/dropper SHA-256 hashes, C2 domains, and distribution URLs, spanning roughly 120 payload samples and 60 dropper samples) to a public GitHub repository alongside the blog post.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1407 Download New Code at Runtime
- T1406 Obfuscated Files or Information
- T1628.001 Hide Artifacts: Suppress Application Icon
- T1541 Foreground Persistence
- T1626.001 Abuse Elevation Control Mechanism: Device Administrator Permissions
- T1453 Abuse Accessibility Features
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1516 Input Injection
- T1629.002 Impair Defenses: Device Lockout
- T1418 Software Discovery
- T1636.003 Protected User Data: Contact List
- T1636.004 Protected User Data: SMS Messages
- T1533 Data from Local System
- T1512 Video Capture
- T1513 Screen Capture
- T1437 Application Layer Protocol
- T1521 Encrypted Channel

## Sources

- [The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile](https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile)
- [Zimperium IOC Repository: 2026-08-ToxicPanda](https://github.com/Zimperium/IOC/tree/master/2026-08-ToxicPanda)
- [ToxicPanda: a new banking trojan from Asia hit Europe and LATAM](https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam)
- [ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud](https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html)
- [ToxicPanda Android Malware Can Steal Banking PINs and Gain Shell Access to Phones](https://cybersecuritynews.com/toxicpanda-android-malware/)
- [New Android banking Trojan ToxicPanda 2.0 expands victim targeting](https://www.scworld.com/brief/new-android-banking-trojan-toxicpanda-2-0-expands-victim-targeting)
- [Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight](https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/)
- [Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps](https://www.infosecurity-magazine.com/news/updated-toxicpanda-140-banking/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2128