A new iteration of the ToxicPanda Android banking trojan presents heightened risks for mobile users by stealing banking PINs, mimicking trusted interfaces, and gaining extensive control over infected devices through developer-oriented features.
Enhanced Reach and Capabilities
ToxicPanda 2.0 introduces a significant expansion in target scope and remote functionalities compared to its predecessors. Distributed via malicious files in Amazon AWS buckets, it employs deceptive installation processes to secure critical Android permissions from users.
Security researchers at Zimperium uncovered this updated threat, noting it supports 167 remote commands. The malware campaign targets over 140 banking and cryptocurrency applications for PIN extraction, with fraudulent login overlays affecting 349 financial institutions across 16 countries.
Exploiting Android Features
The malware’s operation relies on more than just capturing passwords. Once on a device, ToxicPanda can track app usage, gather on-screen data, record touch inputs, display misleading pages, and maintain device access. Previous activity reports indicate infections surpassing 4,500 devices, predominantly in Portugal and Spain.
According to a report shared with Cyber Security News by Zimperium, the latest variant also leverages Android Wireless Debugging to achieve shell-level access. This tactic allows hackers to execute commands and bypass standard Android security measures without needing direct physical access to the device.
Technical Methods and Implications
The infection process begins with a dropper application that masquerades as a legitimate installer, requesting VPN permissions. This enables the malware to disrupt connections to Google Play services before deploying its concealed payload.
Accessibility permissions are pivotal, allowing ToxicPanda to view on-screen content and interact with the interface. The malware inventories device applications, transmitting their details to a command-and-control server, which can then deliver an HTML overlay mimicking authentic app screens.
The malware’s abuse of Wireless Debugging is particularly alarming. Automated interactions enable Developer Options, activate Wireless Debugging, initiate pairing, and retrieve the temporary pairing code, facilitating connection to the local ADB service to gain shell user capabilities.
Mitigation and Precautions
ToxicPanda can also deceive users with fake lock screens to capture device-unlock credentials. In some instances, attackers employ full-screen system updates to hide their activities, echoing tactics seen in other Android banking threats.
The updated commands include requests for Device Administrator privileges and the ability to reset a device’s lock-screen password. Another command can load a malicious web page in full-screen mode, further facilitating phishing attacks.
To mitigate risks, users should refrain from installing APKs from untrusted sources and be cautious of unexpected permission requests. Organizations should monitor for unusual Accessibility activities, developer setting changes, and ADB pairing events to detect and prevent persistent control by attackers.
