ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries
ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions […]
ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions across 16 countries, up from 16 apps in the previous version, plus a command set that ballooned to 167 remote instructions.
The infection starts with a fairly standard trick dressed up in a new coat of paint. The malware poses as a dropper, requesting VPN permissions through a fake installation screen, then quietly uses that access to block communication from Google Play Protect while it decrypts and installs the real payload hiding inside the app’s own asset files. Once installed, it leans on Android’s Accessibility Service, the same feature legitimate screen readers and automation tools rely on, to see and interact with everything happening on the victim’s screen.
Source: https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html
Related breach coverage
- Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION2026-08-23
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 Countries Malware Hijacks Android Car Head Units […]
- PaperCut Flaws Exploited in Attacks on U.S. and European Schools2026-09-05
Attackers are exploiting two new PaperCut flaws to steal credentials and gain privileged access in education-sector attacks across the U.S. and Europe. Attackers are exploiting two recelty disclosed PaperCut flaws, CVE-2026-81578 and CVE-2026-82078, in attacks targeting schools and other education organizations in the U.S. and Europe, as reported by TheHackerNews. Arctic Wolf researchers observed threat […]
- Attackers Exploit Critical Cisco FMC Flaw to deploy Qilin ransomware2026-09-11
Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware. Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical authentication bypass that lets unauthenticated attackers remotely bypass security controls, run […]
- Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews2026-09-10
Deceptive apps in Early Access are being used by dishonest developers for their own benefit. The post Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews appeared first on SecurityWeek.