ToxicPanda Android malware evolves with VPN abuse
ToxicPanda 2.0 Android malware uses VPN permissions to block Google Play
BleepingComputer reports that the ToxicPanda Android banking trojan has reappeared with substantially upgraded capabilities, now going after 349 banking, financial, cryptocurrency, and e-wallet apps across 16 countries and supporting 167 remote commands.
Zimperium zLabs researchers found that version 2.0 requests VPN service permissions to set up a local interface for directing network traffic, which lets it cut off communication with Google Play and Google Play Services. This network-layer control allows the malware to block app verification checks, updates, and Play Protect protections before deploying its payload.
The most notable technical advance is the malware's automated exploitation of Android Debug Bridge (ADB) to reach shell-level access. Using Accessibility Services, ToxicPanda enables Developer Options, turns on Wireless Debugging, pulls the six-digit ADB pairing code and port, and connects to the device's local ADB service. Once it has shell-level permissions, it bypasses Android's runtime consent prompts to grant itself extensive privileges, disable OS background restrictions, and ensure persistence. The malware also includes a PIN-theft module aimed at 140 financial and cryptocurrency apps, fakes the Android lock screen to capture unlock codes, and displays fake system update screens to conceal its activity.
ToxicPanda 2.0 is distributed through Amazon Web Services storage buckets. A command called "autoBoot" detects the device manufacturer and launches OEM-specific auto-start settings to maintain persistence on Xiaomi, OPPO, Vivo, Samsung, and Huawei hardware. The use of wireless ADB for shell access is an emerging trend in Android malware, previously seen in the RedHook family. Zimperium has published indicators of compromise for this variant.