{
	"id": "e3f23364-539a-4b14-b558-241c9939473a",
	"created_at": "2026-09-15T02:02:40.132547Z",
	"updated_at": "2026-10-20T09:05:07.509786Z",
	"deleted_at": null,
	"sha1_hash": "3aa765dbf41e64092ba662cecc2f46bbb4c50b38",
	"title": "The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1843218,
	"plain_text": "https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nThe ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next\n\nStrike on Mobile\n\nBy Vishnu Pratapagiri\n\nPublished: 2026-08-19 · Archived: 2026-09-15 02:01:20 UTC\n\nExecutive Summary\n\nThe zLabs team recently identified an updated variant of ToxicPanda, the Android banking Trojan known to have\n\nprimarily targeted Europe, that introduces significant enhancements, including a comprehensive command set of\n\n167 remote commands and substantially expands its targets globally. Among the newly added capabilities is a PIN\n\ntheft mechanism targeting more than 140 banking and cryptocurrency applications. By abusing the Android\n\nAccessibility Service, threat actors can steal every UI element on the screen, alongside an overlay-based credential\n\ntheft mechanism targeting 349 financial institutions, compared to the previous version, which targeted only 16\n\nbanking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities.\n\nSeveral commands previously identified as unimplemented in Cleafy’s analysis are now fully operational,\n\nexpanding the malware’s remote control and fraud capabilities.\n\nThe malware also introduces an automated click-based mechanism to abuse Android Wireless Debugging (ADB),\n\nenabling privilege escalation and shell-level access on compromised devices. Additionally, it can steal lock screen\n\ncredentials by placing overlays on top of the lock screen. The updated campaign also reveals a shift in distribution\n\nmethods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the\n\nattackers are leveraging cloud infrastructure for malware delivery.\n\nTechnical Analysis\n\nToxicPanda 2.0 continues to abuse Android Accessibility Services to enable remote control capabilities and\n\nautomate fraudulent activities, similar to its previous variants. However, this updated version introduces several\n\nnew commands focused on data theft and expanded malicious functionality. Operating as a dropper, the malware\n\nfirst requests VPN service privileges to block network communication from Google Play and Google Play\n\nServices on the victim’s device. To achieve this, it presents a fake installation interface (Figure 1) through a\n\nWebView and prompts the victim to grant VPN permissions. Once this environment is prepared, the malware\n\ndecrypts and extracts the actual payload stored within the application’s assets folder and proceeds with its\n\ninstallation (Figure 2).\n\nPage 1 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nFig.1: Dropper requesting VPN permission to the victim before payload installation\n\nPage 2 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nFig.2: Malware installs the payload and requests Accessibility Service permissions.\n\nCommand and Control Server\n\nThe interface of the command-and-control (C2) panel has been updated by the malware developers to feature a\n\n\"v2\" title (Figure 3), suggesting a newer iteration of ToxicPanda.\n\nPage 3 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nFig.3: ToxicPanda 2.0 control panel\n\nJust like the previous version, ToxicPanda 2.0 establishes communication with its C2 infrastructure by sending an\n\ninitial HTTPS request to the remote server to establish a persistent WebSocket connection. This WebSocket\n\nchannel enables low-latency, bidirectional communication, allowing the malware to receive commands and\n\nexchange data with the C2 server in real time. Similar to previous versions, ToxicPanda 2.0 secures C2\n\ncommunication using AES encryption in ECB mode. The encryption key is embedded inside the source code and\n\nderived from a static byte array and converted into a string representation before use.\n\nAn example of the HTTPS handshake and subsequent WebSocket-based communication flow is shown in Figure\n\n4.\n\nFig.4: Malware communicating through WebSocket to command and control server\n\nExpansion of Targeted Injections\n\nPage 4 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nUpon installation, the malware enumerates all applications installed on the victim's device and transmits their\n\npackage names and icons to the command-and-control (C2) server, allowing the operator to identify installed\n\nbanking and financial applications. ToxicPanda 2.0 significantly expands its targeting scope, supporting phishing\n\noverlays for 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries. When the\n\nvictim launches one of these targeted applications, the malware requests a corresponding malicious HTML\n\noverlay from the C2 server. Some examples are shown in Figure 5.\n\nFig.5: Malware overlays on top of the victim’s screen\n\nThese overlays closely replicate the appearance of the genuine application's login or transaction screens, tricking\n\nvictims into entering credentials, PINs, and other sensitive information that are subsequently exfiltrated to the\n\nattacker. Figure 6 summarizes the location of targeted financial institutions across the 16 targeted countries.\n\nPage 5 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nAutomating Wireless Debugging Pair\n\nThe Wireless Debugging framework is an Android feature (introduced in Android 11) that allows developers to\n\nrun Android Debug Bridge (ADB) commands and debug applications over Wi-Fi without requiring a physical\n\nUSB connection. The malware abused the Accessibility Service enabling wireless debugging to get \u003cshell\u003e user\n\ncapabilities to run some commands on the device.\n\nPhase 1: Enabling Developer Options\n\nThe malware initially determines whether Developer Options are already enabled on the device. If inactive, it\n\nlaunches the system’s \"About Phone / Device Info\" settings page and queries the accessibility node hierarchy to\n\nlocate the \"Build number\" view. Upon finding the element, it simulates seven rapid tap events in quick\n\nsuccession to unlock developer mode.\n\nPhase 2: Navigating to Wireless Debugging \u0026 Toggling the Switch\n\nOnce Developer Options are enabled, the malware issues an intent to launch the\n\nAPPLICATION_DEVELOPMENT_SETTINGS view. It then queries the accessibility layout hierarchy to\n\nlocate the \"Wireless debugging\" entry and toggles the switch to the ON state.\n\nPhase 3: Triggering \u0026 Scraping the SPAKE2 Pairing Code\n\nTo initiate TLS-based pairing, the malware identifies and interacts with the \"Pair device with pairing code\"\n\noption. Once triggered, it continuously polls the layout hierarchy of the newly spawned modal dialog to extract the\n\ngenerated 6-digit PIN (Figure 7) and the dynamic connection port.\n\nPage 6 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nFig.7: Enable Wireless debugging and get pairing code\n\nPhase 4: Cryptographic Authenticated Pairing\n\nArmed with the extracted pairing code and dynamic port, the application instantiates a local SPAKE2 pairing\n\nhandler to authenticate its generated keypair with the local ADB daemon listening on 127.0.0.1. It then establishes\n\na TLS-encrypted channel, executes the SPAKE2 key exchange using the extracted 6-digit PIN, and securely trades\n\npeer identity metadata to finalize the pairing process.\n\nPhase 5: Shell-Level Post-Pairing Privilege Escalation\n\nOnce the malware gains shell user permissions, it starts executing high-privilege commands directly through the\n\nADB daemon, the malware bypasses standard Android runtime consent prompts to grant itself broad permissions,\n\nneutralize OS background restrictions, silently enable critical components, and enforce persistence.\n\nStealing device lock credentials via overlays\n\nPage 7 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nAnalysis of recent variants highlights a newly incorporated capability designed to harvest device unlock\n\ncredentials, specifically PINs, patterns, and passwords (Figure 8). By capturing these authentication factors, threat\n\nactors can bypass screen lock barriers and maintain persistent, uninhibited access to compromised endpoints. To\n\nexfiltrate these credentials, the malware executes a screen overlay attack, deploying a spoofed interface that\n\nseamlessly mimics the native Android lock screen.\n\nFig.8: Malware overlay used to steal password of the victim\n\nFake System Updates\n\nIn some of the samples collected, the malware conceals its background actions by displaying deceptive \"system\n\nupdate\" full screen lock activity over the screen (Figure 9). These templates are rendered using local HTML\n\ntemplates loaded directly from the application's assets/ directory or built from resources/, effectively obscuring\n\nongoing malicious activity from the victim's view.\n\nPage 8 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nFig.9: Fake update layouts by the malware\n\nMonitoring Financial Applications\n\nThe malware targets financial, banking, e-wallet, and cryptocurrency applications through a multi-step PIN\n\nharvesting workflow involving application detection, touch capture, and data exfiltration. It monitors the\n\napplication currently running on the device through Accessibility Services and checks whether it matches its\n\nconfigured list of targeted applications. When a targeted application is opened, the malware starts its PIN\n\nharvesting process.\n\nAs the victim uses the targeted banking or payment application, the malware deploys an invisible transparent\n\noverlay to capture touch that the victims entered.\n\nThe malware also supports dynamic target updates through the \u003creplacePinTargets\u003e command. Upon receiving\n\nconfiguration data from the C2 server, it can replace the existing package and keyword lists with attacker\n\ncontrolled values, allowing operators to update the applications targeted for PIN harvesting.\n\nImplementation of commands from previous versions\n\nIn the version disclosed by Cleafy some of the functionalities were still in development and not available. In this\n\nnew version, instead, some commands are now implemented and working.\n\nAndroid OEM Permission Automation Config\n\nPage 9 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nThe command \u003ccatAllViewSwitch\u003e (Figure 10), enables the malware to programmatically identify and auto-\n\nnavigate system permission dialogs, battery optimization prompts, and vendor-specific auto-start configuration\n\nscreens across a broad range of Android Original Equipment Manufacturer (OEM) ecosystems.\n\nBy parsing OEM-customized layout trees and matching localized button text strings, the threat automatically\n\ninteracts with target UI controls (such as \"Allow\", \"Don't Optimize\", or their multilingual equivalents). This\n\nautomated interaction allows the malware to secure arbitrary runtime permissions and enforce background\n\npersistence without requiring explicit user intervention.\n\nFig.10: Receiving catAllViewSwitch command from c2\n\nDevice Administrator Exploitation Commands\n\n\u003cadmSet\u003e:\n\nIssues an explicit system Intent (android.app.action.ADD_DEVICE_ADMIN) to prompt the victim to grant\n\nDevice Administrator privileges. To entice compliance, the malware presents a social engineering lure with the\n\ncustom prompt: \"System service requires administrator privileges\"\n\n\u003cadmPwd\u003e:\n\nLeverages DevicePolicyManager.resetPassword() to programmatically force-reset or overwrite the device's local\n\nlock screen PIN/password with an attacker-defined string, effectively enabling screen lockout or unauthorized\n\nphysical device hijacking.\n\nTransparent Overlay Interface\n\n\u003ctransparent\u003e:\n\nPage 10 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nThe malware remotely loads an attacker-controlled URL inside a full screen WebView activity, enabling the\n\ndisplay of malicious web content for phishing or deception purposes. This transparent command was not\n\nimplemented by the previous versions of the malware.\n\nOEM Auto-Start Bypass Logic\n\nTo maintain operational persistence across Android’s fragmented OEM ecosystem, the malware leverages the\n\n\u003cautoBoot\u003e command to bypass aggressive vendor-specific power management features. Major Android\n\nmanufacturers such as Xiaomi, OPPO, Vivo, Samsung, and Huawei enforce proprietary battery optimization\n\npolicies and auto-start restrictions that frequently kill background processes to conserve battery, directly\n\nthreatening the malware's longevity.\n\nBecause the core Android framework lacks a unified public API to manage these proprietary power controls, the\n\nmalware queries Build.MANUFACTURER to dynamically profile the host device. Upon identifying the OEM\n\nbuild, it dispatches targeted, vendor-specific Intents to open internal configuration activities such as Xiaomi's\n\nMIUI Security Center or Samsung's Smart Manager. Once launched, the threat uses its Accessibility Service to\n\nwhitelist the application, securing uninterrupted background execution and preventing process termination.\n\nZimperium vs ToxicPanda\n\nAs mobile banking threats like ToxicPanda become increasingly sophisticated, conventional signature-based\n\nsecurity layers are no longer sufficient to protect enterprise mobile endpoints. Zimperium provides\n\ncomprehensive, multi-layered protection designed to disrupt every stage of the ToxicPanda execution chain.\n\nAdvanced Malware and Dropper Detection: Both Zimperium MTD (Mobile Threat Defense)\n\nand zDefend (Mobile Application Runtime Protection) are engineered to detect the initial dropper\n\nsamples, including those masquerading behind fake VPN permission screens. By utilizing its on-\n\ndevice dynamic detection engine, Zimperium stops the infection chain before the malware can\n\nextract, decrypt, and install its hidden payloads from the application's assets folder.\n\nCloud Infrastructure and C2 Mitigation: ToxicPanda 2.0 has shifted its delivery tactics to\n\nleverage Amazon AWS-hosted buckets and relies on persistent WebSocket connections for low-\n\nlatency remote control. Zimperium's Web Content Filtering and network defense capabilities\n\nactively monitor and block access to these known malicious pathways. This protects users at the\n\npoint of ingress by preventing the initial download and acts as a fail-safe by severing AES-\n\nencrypted communications to Command and Control (C2) servers if an infected device attempts to\n\nexfiltrate stolen assets.\n\nBehavioral Indicators and Anti-Fraud Telemetry: This iteration of ToxicPanda aggressively\n\nabuses legitimate Android framework features, most notably Accessibility Services and the Wireless\n\nDebugging (ADB) framework, to bypass user consent and achieve shell-level access. zDefend\n\nenables customers to detect these real-time fraud indicators directly on the device. By identifying\n\nwhen automated UI manipulation, unauthorized ADB pairing, or targeted HTML overlays are\n\noccurring during sessions with any of the targeted financial applications, organizations can instantly\n\nflag behavioral anomalies and prevent credential and PIN theft.\n\nPage 11 of 12\n\nhttps://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nDevice Manipulation and Overlay Prevention:\n\ndevice settings, including the exploitation of Device\n\ncircumvention of OEM-specific battery optimization policies. Furthermore, on-device telemetry can\n\nidentify the deployment of deceptive interfaces—such as fake system updates or spoofed\n\nlock screens—preventing threat actors from locking victims out of their devices or harvesting\n\nscreen unlock credentials.\n\nCommands used by ToxicPanda 2.0\n\nThe full list of commands can be found in this file.\n\nIOC’s\n\nList of IOC’s can be found in this repository.\n\nSource: https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile\n\nPage 12 of 12\n\nZimperium detects the malicious manipulation of\n\nAdministrator privileges and the automated\n\nAndroid",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile"
	],
	"report_names": [
		"the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile"
	],
	"threat_actors": [],
	"ts_created_at": 1789437760,
	"ts_updated_at": 1792487107,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3aa765dbf41e64092ba662cecc2f46bbb4c50b38.pdf",
		"text": "https://archive.orkl.eu/3aa765dbf41e64092ba662cecc2f46bbb4c50b38.txt",
		"img": "https://archive.orkl.eu/3aa765dbf41e64092ba662cecc2f46bbb4c50b38.jpg"
	}
}