# Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads Malvertising

> Intel 471 reports Chinese-speaking threat actors targeting Spanish-speaking Android users in Mexico (secondary targeting in Nigeria) with the PanDa remote access Trojan, delivered by the ShellA loader through Meta Ads malvertising and phishing pages impersonating Netflix and a rotating set of twelve fictitious streaming brands.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2279
- **ID:** TL-2026-2279
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PanDa is a newly documented Android remote access trojan tracked by Intel 471, deployed by a Chinese-speaking threat cluster (attributed via Chinese-language text throughout the AppPanda phishing management panel) against Spanish-speaking Android users, primarily in Mexico with secondary targeting in Nigeria. Since at least May 2026, victims have been lured through Meta Ads (Facebook/Instagram) linking to phishing landing pages that initially impersonated Netflix. In July 2026 Intel 471 observed the actors shift tactics, launching campaigns impersonating a new fictitious brand, NovaFlix, alongside a growing list of additional fictitious streaming-service brands that ultimately included AlvoPlay, CeloloPlay, CineviaBox, EvotiPrime, FaroreLive, HalogoBox, HalonaNow, NovaoraPrime, PicomiPlay, RivasaTV, UltraTV, and VivaPlay. In August 2026 a further campaign wave impersonated Netflix and other legitimate streaming services. Victims who enable "install from unknown sources" are prompted to install the ShellA loader APK, which verifies sideloading is already enabled, decrypts and installs a bundled PanDa payload via dynamic APK reassembly with a per-build randomized signature, and, once installation completes, launches PanDa and requests Android Accessibility Services permission.

Once Accessibility Services access is granted, PanDa gives operators keylogging (stealing credentials entered into banking-app login pages), screen streaming/HVNC (hidden virtual network computing) for live device viewing and remote control, screen-lock capture, and device settings manipulation, communicating with its command-and-control infrastructure over an unencrypted WebSocket connection. The malware dynamically enumerates installed application package names to identify which of 62 targeted banks and financial institutions across Mexico and Nigeria are present on the victim device before selectively harvesting credentials.

The campaign runs on a fully operationalized criminal infrastructure ecosystem centered on the AppPanda panel: a Chinese-language phishing management dashboard that, per Intel 471's review, had 11 configured landing-page templates (each defining a phishing-page title, visual theme, domain name, and associated malicious APK payload) alongside campaign-traffic statistics and automated registration of new phishing domains. AppPanda is fed by the APK Factory payload-builder service (which also generates the unrelated BTMOB Android banking trojan), the BAT1688 crypting/obfuscation platform (which re-signs PanDa payload APKs roughly every 60 minutes to defeat hash-based antivirus detection), and the Appchi ("Pixel Center") Facebook ad-campaign management interface, which is integrated with the HuiTongCard virtual payment service for tracking ad spend and uses disposable "jump domains" embedded in the Meta ad units to shield the phishing infrastructure from takedown. Over a single tracked one-week window beginning July 2, 2026, the AppPanda panel logged more than 350,000 landing-page visits, 200,000 unique visitors, and nearly 15,000 malicious APK downloads across at least 22 newly registered phishing domains. Operators tracked install conversion using the PromoLink attribution identifier and Facebook Click Identifier embedded in the ad links to resolve APK payload URLs; by August 2026 they had added Facebook Pixel SDK integration to further optimize which ads drove the most downloads.

Intel 471 assesses the campaign as active and ongoing as of its September 1, 2026 disclosure, anticipating expansion into additional geographic regions, and recommends correlating live C2 traffic, infrastructure pivots, and newly registered phishing domains (via tooling such as its Retroactive Threat Detection capability and Brand Exposure module) for early detection.

This campaign fits a broader 2026 pattern of Meta-Ads-delivered Android RATs targeting Spanish-speaking users via streaming- and finance-app lures — including the unrelated Mirax RAT campaign (a private MaaS reaching 220,000+ Facebook/Instagram/Messenger/Threads accounts and embedding residential-proxy functionality in a banking trojan), Bitdefender-tracked crypto-stealing malvertising expanding from browser to Android, and the Brokewell-delivering Meta malvertising cluster documented by Security Affairs — reflecting a maturing underground supply chain of payload builders (APK Factory), crypting services (BAT1688), and ad-fraud/attribution tooling (Appchi/Pixel Center, HuiTongCard) supporting Android banking-fraud operations at scale.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Match Legitimate Name or Location
- T1406.002 Software Packing
- T1629.003 Disable or Modify Tools
- T1626 Abuse Elevation Control Mechanism
- T1417.001 Keylogging
- T1513 Screen Capture
- T1516 Input Injection
- T1437.001 Web Protocols
- T1418 Software Discovery
- T1583.001 Domains
- T1588.001 Malware

## Sources

- [Chinese-speaking threat actors targeting Mexican Android users with remote access Trojan](https://www.intel471.com/blog/chinese-speaking-threat-actors-targeting-mexican-android-users-with-remote-access-trojan)
- [Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users in Global Financial Fraud Scheme](https://thehackernews.com/2026/05/grandoreiro-malware-and-btmob-rat.html)
- [BTMob Fraud-as-a-Service Platform Uses 1,400 Live Servers to Power Global Banking Fraud](https://cybersecuritynews.com/btmob-fraud-as-a-service-platform/)
- [Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000+ Accounts via Meta Ads](https://thehackernews.com/2026/04/mirax-android-rat-turns-devices-into.html)
- [Active Exploitation Alert: Grandoreiro Banking Trojan and BTMOB RAT Targeting Windows and Android Users in Global Financial Fraud](https://www.rescana.com/post/active-exploitation-alert-grandoreiro-banking-trojan-and-btmob-rat-targeting-windows-and-android-users-in-global-financi)
- [Malvertising Campaign on Meta Expands to Android, Pushing Advanced Crypto-Stealing Malware to Users Worldwide](https://www.bitdefender.com/en-us/blog/labs/malvertising-campaign-on-meta-expands-to-android-pushing-advanced-crypto-stealing-malware-to-users-worldwide)
- [Crooks exploit Meta malvertising to target Android users with Brokewell](https://securityaffairs.com/181789/malware/crooks-exploit-meta-malvertising-to-target-android-users-with-brokewell.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2279