ToxicPanda 2.0 widens Android banking attack reach

ToxicPanda 2.0 is a more advanced Android banking Trojan that can steal PINs, gather financial credentials and control compromised smartphones remotely. This upgraded version targets over 140 banking and cryptocurrency applications, extending its reach to 349 applications across 16 countries. One significant addition is an invisible overlay that can be placed over legitimate apps, capturing user inputs without displaying fraudulent screens.

ToxicPanda 2.0 also retrieves HTML phishing pages from its command-and-control infrastructure. The malware's remote-control framework now includes 167 commands, allowing operators to manipulate devices with greater authority. Android Accessibility Services are crucial for the malware's operation, enabling it to monitor interface elements, simulate clicks and interfere with security settings.

The malware can enable Wireless Debugging and abuse Android Debug Bridge, providing shell-level capabilities that allow attackers to maintain control, manipulate settings and prepare the device for fraudulent transactions. ToxicPanda 2.0 can also display a fraudulent lock interface to capture users' PINs or passwords. The malware communicates with its command-and-control infrastructure via an initial HTTPS connection and a bidirectional WebSocket channel, supporting interactive fraud operations.

Distribution tactics have shifted to using Amazon Web Services storage buckets, making the malware appear less suspicious. ToxicPanda 2.0 expands on earlier versions, adding new capabilities for privilege escalation, persistence and credential interception.