Cybersecurity experts have uncovered a new iteration of the ToxicPanda malware, significantly enhancing its capabilities and expanding its global reach. Known for its ability to conduct on-device fraud, ToxicPanda 2.0 now boasts 167 remote commands, targeting over 140 banking and cryptocurrency applications worldwide.
Enhanced Capabilities of ToxicPanda 2.0
The Android malware exploits the operating system’s accessibility services, enabling cybercriminals to capture every UI element on the screen. This iteration vastly increases its attack surface, now targeting 349 financial institutions across 16 countries, compared to the previous focus on just 16 applications. Its new features include a PIN harvesting workflow and the ability to siphon lock screen credentials using fake overlays.
In addition, the malware automates privilege escalation by abusing Android Wireless Debugging via the Android Debug Bridge (ADB). This is achieved through accessibility services that activate Developer Options and enable Wireless Debugging, providing attackers shell-level access.
Communication and Delivery Tactics
ToxicPanda 2.0 connects to a command-and-control (C2) server through an initial HTTPS request, establishing a WebSocket communication channel for data exchange. The malware can also display full-screen system update overlays to hide its activities while capturing touch inputs and PIN codes using transparent overlays.
Furthermore, there is a notable shift in how the malware is distributed. Attackers now use Amazon AWS-hosted buckets for delivery, demonstrating a strategic move to leverage cloud infrastructure for deploying malware.
GoldDigger’s Campaign in South Africa and the UK
The GoldDigger malware, linked to the GoldFactory threat group, has been identified as another major player in Android banking threats. First reported by Group-IB in October 2023, it uses a sophisticated packer to obfuscate its code, making analysis difficult. This malware primarily targets South Africa and the UK by masquerading as airline and retail apps.
GoldDigger employs accessibility services to mimic user interactions within banking apps, initiating unauthorized transactions. It can also provide real-time access to the victim’s screen and capture credentials via fake overlays, giving attackers extensive visibility and control over the infected device.
Users are advised to remain vigilant by reviewing app permissions and ensuring their devices are up-to-date. Downloading apps from trusted sources and enabling two-factor authentication (2FA) for online accounts are also recommended to mitigate these threats.
