【CyCraft Monthly Intelligence】ToxicPanda 2.0 Goes Global: Android Accessibility Services Abused to Hit Nearly 350 Financial Institutions

‍

Threat and Impact

ToxicPanda 2.0 is an upgraded version of an Android banking malware that initially targeted European banking users and has now spread to 349 financial institutions across 16 countries, stealing PINs from more than 140 banking and cryptocurrency apps. Once a deviceis infected with ToxicPanda 2.0, the malware tricks the user into granting permission and installs a hidden payload, then connects to its C2 over encrypted WebSocket, allowing the attackers to issue commands, deploy phishing screens, steal data, and remotely control the device. ToxicPanda 2.0 can also use fake or transparent overlays to steal login credentials, PINs, and transaction information, and can capture lock-screen PINs, patterns, and passwords, which it can then use to reset the device's lock settings.

ToxicPanda was first disclosed in late 2024 as a simplified off shoot of the well-known TgToxic trojan. At that stage its capabilities were relatively basic, focused mainly on initiating automated transfers and intercepting SMS OTPs. Version 2.0 has evolved from an"early-stage test tool" into a "highly modular threat capable of large-scale, multi-country attacks." It can even automatically enable Wireless Debugging and pair with the ADB daemon to obtain shell-level access, which it uses to bypass prompts, disable restrictions, and strengthen persistence, giving it capabilities close to a full device takeover.

For financial institutions, payment providers, digital wallets, cryptocurrency services, and enterprises, the mainrisks include account takeover, unauthorized transactions, and leakage of credentials and corporate data. Because the attacks take place on legitimate users' own devices, they are harder to detect on the back end. The malware's use of AWS storage buckets for delivery and encrypted WebSocket communications also makes network-layer detection and blocking more difficult.

Analyst Perspective

ToxicPanda 2.0 deserves attention not only because its attack techniques have been upgraded, but because of what it signals: mobile malware is shifting from "stealing credentials" to "controlling the user's device and transaction flow." By abusing legitimate Android Accessibility Services, the attackers reduce their relianceon vulnerability exploitation, making traditional defenses centered on CVEs, malicious file signatures, or network indicators far easier to bypass. For financial institutions, future risk assessment cannot rely only on whether anaccount, IP address, or device looks familiar; it must place greater weight on device integrity, unusual permissions, interaction behavior, and transaction context. We believe defenders should no longer treat mobile devices as mere personal endpoints, but should actively bring them into account security and endpoint risk management.

Technical Details

ToxicPanda 2.0 is a new type of Android banking trojan that combines dropper behavior, overlay phishing, Accessibility Service abuse, encrypted WebSocket command and control, and automated Android Wireless Debugging. Rather than relying on a single Android vulnerability, the campaign systematically abuses legitimate Android features (such as the VPN service, Accessibility Services, WebView overlays, DeviceAdministrator APIs, OEM auto-start settings, and Wireless Debugging/ADB) to gain visibility into the victim's screen, automate execution, steal credentials, and increase its control over the device.

Compared with earlier ToxicPanda variants, version 2.0 is far more operationally mature: it supports a command set of 167 remote commands, expands its overlay targets to 349 financial institutions in 16 countries, and includes PIN-theft logic targeting more than 140 banking and cryptocurrency apps. Several capabilities previously observedas incomplete are now fully implemented, including Device Administrator abuse, transparent WebView overlays, OEM permission automation, and auto-start persistence logic.

Reconnaissance

After installation, ToxicPanda 2.0inventories all installed applications on the victim's device. The malwarecollects app package names and icons and sends them to its command-and-controlserver. This tells the operators which banking, financial, e-wallet, orcryptocurrency apps are installed on the device, helping them decide whichphishing overlays or PIN-harvesting flows to deploy.

The malware also continuously monitors the foreground app through Android Accessibility Services. When the victim opens a targeted banking or financial app, ToxicPanda 2.0 detects the package and triggers the corresponding malicious flow. This makes the malware context-aware: rather than displaying phishing content at random, it waits until the victim interacts with a relevant app, increasing the likelihood of capturing credentials.

ToxicPanda 2.0 also performs reconnaissance of the Android system interface itself. During the Wireless Debugging abuse flow, it checks whether Developer Options are enabled, queries the accessibility node hierarchy, searches for UI elements such as "Buildnumber," "Wireless debugging," and "Pair device with pairing code," and extracts the dynamic ADB pairing code and port from the screen.

Resource Development

ToxicPanda 2.0 operators prepared both malware delivery infrastructure and command infrastructure, using Amazon AWS-hosted storage buckets to distribute ToxicPanda samples. Compared with obscure or newly registered malicious domains, hosting payloads on commercial cloud infrastructure is less likely to raise suspicion and offers greater scalability and operational flexibility.

The attackers also continue to maintain the ToxicPanda 2.0 command-and-control environment. The currently observed C2 panel carries a "v2" title, indicating that this version uses an updated operational back end. The infrastructure supports real-time device control, overlay delivery, target updates, command execution, and data exfiltration.

Initial Access

The initial access point is the victim downloading and installing the ToxicPanda 2.0 dropper. After installation, the malware presents a fake installation interface through a WebView, which is used to guide the victim into granting permissions useful to the malware. Notably, the dropper first requests VPN service permission. The malware uses this VPN capability to block network traffic from Google Play and Google Play Services, likely to reduce the chance of Google's security mechanisms interfering with the next-stage installation.

With this environment prepared, the dropper decrypts and extracts the real malicious payload from the app's assets folder. It then installs the payload and requests Accessibility Service permissions, which are the core of the rest of the attack chain.

Execution

Execution begins with the dropper's staged payload deployment: the initial application contains an encrypted payload stored in its assets directory. At runtime, ToxicPanda 2.0 decrypts the payload, extracts it, and proceeds with installation. This allows the app to act as a loader while hiding its real malicious functionality until the initial permissions are obtained.

Once activated, the payload establishes communication with its C2 server and waits for remote commands. ToxicPanda 2.0 supports 167 remote commands, giving operators broad control over infected devices. These commands can activate phishing overlays, update target lists, automate permissions, abuse Device Administrator, load WebViews, manipulate Wireless Debugging, and perform other malicious actions.

One of its major execution capabilities is automated abuse of Android Wireless Debugging. The malware uses Accessibility Services to perform UI actions that would normally require user interaction. It can:

• Open the Android "About phone" settings page.
• Locate the "Build number" element.
• Simulate seven rapid taps to enable Developer Options.
• Open Developer Options.
• Locate and enable "Wireless debugging."
• Open the pairing code dialog.
• Capture the 6-digit pairing PIN and dynamic port.
• Pair with the local ADB daemon.
• Execute shell-level commands via ADB.

This attack chain lets the malware move from app-level execution to shell-level command execution without exploiting at raditional memory corruption vulnerability.

Persistence

ToxicPanda 2.0 hides a diverse set of persistence mechanisms designed to keep the malware running even in the faceof Android background restrictions, battery optimization, reboots, and OEM-specific power management controls.

The malware's abuse of Accessibility Services is itself a form of persistence. Once the victim grants Accessibility permissions, ToxicPanda 2.0 can interact with system dialogs, approve permission prompts, navigate settings, and manipulate device controls on the victim's behalf.

• The<catAllViewSwitch> command automates interaction with Android permission dialogs, battery optimization prompts, and OEM-specific settings screens. By parsing the UI layout tree and matching localized button text such as "Allow" or "Don't optimize," the malware can grant itself permissions and remove restrictions with almost no meaningful user involvement.
• The <autoBoot> command targets OEM-specific auto-start and battery management features. Android manufacturers such as Xiaomi, OPPO, Vivo, Samsung, and Huawei often include proprietary power management systems that restrict background app execution. ToxicPanda 2.0 uses Build.MANUFACTURER to identify the device manufacturer and opens the relevant vendor settings activity, such as Xiaomi's MIUI Security Center or Samsung's Smart Manager. It then uses Accessibility automation to whitelist itself or enable auto-start, helping it survive process termination and keep running in the background.
• The <admSet> command attempts to obtain Device Administrator privileges. It launches the Android ADD_DEVICE_ADMIN intent and displays a social engineering message: "System service requires administrator privileges." If granted, these privileges provide stronger control over device policy functions and can support longer-term compromise.

In addition, by stealing the victim's PIN, pattern, or password through a fake lock-screen overlay, the attackers may regain access even after the device has been locked, which also serves to extend persistence.

Privilege Escalation

The most important privilege escalation technique in ToxicPanda 2.0 is its automated abuse of Android Wireless Debugging and ADB.

Wireless Debugging is a legitimate Android feature introduced in Android 11 that lets developers connect to ADB over Wi-Fi without a USB cable. ToxicPanda 2.0 turns this feature into a means of malicious privilege escalation. Through Accessibility automation, it enables Developer Options, turns on Wireless Debugging, and opens the "Pair device with pairing code" dialog. The malware then captures the 6-digit pairing code and dynamic port directly from the Android UI.

With this information, ToxicPanda 2.0 initiates a local SPAKE2 pairing process and authenticates with the ADB daemon listening on 127.0.0.1. It establishes a TLS-encrypted channel and completes the SPAKE2 key exchange using the captured pairing PIN. Once pairing succeeds, the malware obtains shell-level access via ADB.

This shell-level access allows ToxicPanda 2.0 to execute commands that ordinary Android apps normally cannot. The malware uses this access to grant itself broad permissions, bypass standard Android runtime consent prompts, neutralize background restrictions, silently enable key components, and enforce persistence.

Device Administrator abuse provides another escalation path. Through <admSet>, the malware attempts to obtain administrative privileges; through <admPwd>, it can use DevicePolicyManager.resetPassword() to reset or overwrite the local lock-screen PIN or password with an attacker-defined value.

Defense Evasion

ToxicPanda 2.0 uses multipledefense evasion techniques to hide its behavior and reduce the likelihood ofdetection or disruption.

First, the malware operates as adropper and stores its encrypted payload in the app's assets folder. The realmalicious payload is not immediately exposed as a standalone component; it isdecrypted and extracted only at runtime. This staged design complicates static analysis and helps conceal the malware's full functionality until execution.

Second, the dropper requests VPN service permission and uses it to block communication with Google Play and Google Play Services. This may interfere with security checks, app verification, or other protective communications from Google components.

Third, ToxicPanda 2.0 fakes installation and VPN permission screens during the initial permission flow, using deceptive screens to mask its malicious behavior, and some samples also display a full-screen fake "System Update" activity. By invoking local HTML templates or app resources from the app's assets directory, it can generate a fake update interface directly; while the victim sees what appears to be a system update, the malware continues to act in the background.

Fourth, C2 communications are encrypted. After establishing an HTTPS connection, ToxicPanda 2.0 maintains a persistent WebSocket channel. Data exchanged over this channel is protected with AES in ECB mode. The AES key is embedded in the malware code and derived from a static byte array. Although AES-ECB with a statically embedded key is not strong operational security once analysts obtain a sample, it is sufficient to obscure inspection.

Finally, the malware evades Android runtime controls by abusing Accessibility Services and Wireless Debugging. Accessibility automation lets it click through permission dialogs and settings screens, while ADB shell access lets it bypass normal user consent mechanisms and manipulate permissions or restrictions at a higher privilege level.

Credential Access

Credential theft is one of ToxicPanda 2.0's main objectives. When the victim opens a targeted app,ToxicPanda 2.0 requests the corresponding malicious HTML overlay from its C2 server. The overlay is displayed on top of the legitimate app and closely mimics its login or transaction interface. Victims who enter user names, passwords, PINs, or other authentication data are in fact submitting them to the attacker-controlled overlay.

ToxicPanda 2.0 uses a PIN-harvesting mechanism targeting more than 140 banking and cryptocurrency apps. When a targeted app is active, the malware deploys an invisible, transparent overlay to capture the victim's touch input. This allows the malware to infer or collect PIN entries while the victim believes they are interacting with a legitimate banking or payment app.

The malware can dynamically update its list of PIN targets using the <replacePinTargets> command. This means operators are not limited to a static list embedded in the APK; theycan push new package names and keywords from the C2 server as their targeting priorities change.

Another important credential access capability is lock-screen credential theft. ToxicPanda 2.0 fakes an Android lock-screen overlay that mimics the native device unlock interface. Itcan collect PINs, patterns, and passwords, allowing the attackers to bypass the victim's screen lock and maintain access to physical or remote device sessions.

Accessibility Services further support credential access by letting the malware read UI elements displayed onscreen, exposing sensitive information shown in banking apps, authentication prompts, or system dialogs.

Discovery

ToxicPanda 2.0 performs extensive discovery after installation to adapt to the compromised device. The malware enumerates installed apps and sends package names and icons to the C2, helping operators identify high-value financial apps on the device. It also monitors running apps to detect when the victim opens a targeted app.

During Wireless Debugging abuse,ToxicPanda 2.0 discovers the state of system settings: it checks whether Developer Options are enabled, locates specific Android settings elements, identifies Wireless Debugging controls, and reads the pairing code and dynamic port from the pairing dialog.

For OEM persistence, ToxicPanda 2.0 identifies the device manufacturer using Build.MANUFACTURER and uses this information to determine which vendor-specific settings activities to launch. For example, Xiaomi, OPPO, Vivo, Samsung, or Huawei devices may require different logic, because each vendor implements background execution, battery optimization, and auto-start controls differently.

The malware also parses the accessibility tree to identify clickable controls, permission prompts, localized approval buttons, and battery optimization options. This discovery allows its automation flows to work across different Android versions, languages, and OEM skins.

Collection

ToxicPanda 2.0 collects several categories of data from victim devices.

The first category is device app inventory data. The malware collects installed app package names and icons and sends them to the C2 server. Although this is part of reconnaissance, it is also collected data that helps drive subsequent targeting.

The second category is screen and UI data. By abusing Android Accessibility Services, ToxicPanda 2.0 can collect UI elements displayed on screen. This lets the malware see what the victim isdoing and what sensitive content may be present.

The third category is financial credentials and PINs. ToxicPanda 2.0 collects credentials entered into phishing overlays that mimic banking, e-wallet, financial, and cryptocurrency apps. It also collects PIN entries through transparent overlays placed over legitimate financial apps.

The fourth category is device unlock credentials. Through a fake Android lock-screen overlay, the malware collects the PINs, patterns, and passwords used to unlock the device.

The fifth category is Wireless Debugging pairing data. ToxicPanda 2.0 captures the 6-digit ADB pairing code and dynamic port from Android system dialogs, then uses this information to pair with the local ADB daemon and obtain shell-level access.

Command and Control (C2)

ToxicPanda 2.0 uses a persistent command-and-control architecture designed for real-time remote control.

The malware first sends an HTTPS request to the remote C2 server, then establishes a persistent WebSocket connection. This WebSocket channel provides low-latency, bidirectional communication, allowing the infected device and operator-controlled infrastructure to exchange commands and data in near real time.

C2 traffic is encrypted with AES in ECB mode. The encryption key is embedded in the malware source code and derived from a static byte array that is converted to a string representation before use. This encryption helps obscure command and data traffic, but the statically embedded key also gives reverse engineers who obtain a sample a weakness to exploit.

The C2 server serves several operational purposes:

• Receiving installed app package names and icons.
• Sending remote commands from the 167-command set.
• Delivering HTML phishing overlays when targeted apps are opened.
• Updating target app lists through commands such as <replacePinTargets>.
• Loading attacker-controlled content through commands such as <transparent>.
• Receiving stolen credentials, PINs, lock-screen data, UI data, and other collected information.

The updated C2 panel displays a "v2" label, indicating that the ToxicPanda back end isstill under active development and operational maintenance.

Exfiltration

ToxicPanda exfiltrates collected data mainly through its encrypted C2 channel. After enumerating installed apps, the malware sends package names and icons to the C2 server. This information lets the attackers classify infected devices and helps them decide which overlays or fraud flows to activate.

Credentials entered into malicious overlays are sent back to attacker infrastructure. These include banking usernames and passwords, transaction authentication data, e-wallet credentials, cryptocurrency app credentials, and financial PINs.

PINs captured through invisible transparent overlays are also exfiltrated. Because these overlays are deployed while the victim interacts with legitimate financial apps, the stolen input maybe used directly for account takeover or unauthorized transaction attempts.

Lock-screen PINs, patterns, and passwords collected through the fake Android lock-screen overlay are likewise sent to the attackers. These credentials can allow persistent access to the device and may enable physical or remote device hijacking.

Screen data and UI elements obtained through Accessibility Services may also be exchanged with the C2 server to support data theft and operator-driven fraud.

Impact

The most direct impact of this campaign is manipulation of the device lock through Device Administrator abuse.

Using the <admPwd> command, ToxicPanda can call DevicePolicyManager.resetPassword() to reset or overwrite the device's local lock-screen PIN or password with an attacker-defined value.This can lock the legitimate user out of the device or give the attackers control over access to it.

More serious is the financial compromise: by stealing banking credentials, app PINs, cryptocurrency wallet access data, and device unlock credentials, ToxicPanda 2.0 can enable account takeover, fraudulent transactions, wallet compromise, and persistent unauthorized access to the victim's mobile endpoint. Its ability to obtain shell-level access through Wireless Debugging and to maintain background execution through OEM-specific persistence logic further raises the severity of the compromise.

Mitigation

No specific Android patch has been identified for the techniques abused by ToxicPanda 2.0. Mitigation therefore depends on reducing exposure to high-risk Android features, detecting maliciouson-device behavior, blocking delivery and command-and-control infrastructure, and adding fraud controls to financial app sessions.

Because ToxicPanda 2.0 mainly abuses legitimate Android services, defenders should treat unexpected changes to these services as high-risk signals, especially when they occur shortly after a new app is installed.

• Guard Against Phishing and Break the Infection Chain Early:
  Download apps only from the Google Play Store, verify the developer's name and reputation, and be cautious when an app requests critical Android permissions, especially the VPN service, Accessibility Services, Developer Options, and Wireless Debugging. For managed devices, enterprises should restrict sideloading, enforce app allowlisting, and prevent installation from unknown sources wherever possible.
  
• Control Sensitive Android Permissions and Services:
  ToxicPanda's effectiveness depends on persuading users to grant powerful permissions. Organizations should enforce policies that restrict access to the following:
  
  • Accessibility Services: Only approved accessibility tools should be allowed. Unknown apps requesting Accessibility access should trigger an alert or be blocked.
  • VPN service: New or untrusted VPN profiles should be monitored, because the malware uses fake VPN prompts and may interfere with Google Play or Google Play Services communications.
  • Device Administrator: Device Administrator activation by unknown apps should be blocked or treated as an indicator of compromise.
  • Overlay permission: Apps that can draw over other apps may be used for phishing, PIN theft, fake lock screens, and invisible touch capture.
  • Battery optimization exemptions and auto-start settings: ToxicPanda attempts to whitelist itself on OEM devices to maintain persistence.
  • On enterprise-managed Android devices, MDM/EMM policies should disable unnecessary permission grants, restrict high-risk settings, and quarantine devices that show suspicious permission changes.
• Detect Accessibility Abuse and Overlay Fraud:
  Accessibility Services are at the core of ToxicPanda 2.0. The malware uses them to read screen elements, monitor the foreground app, auto-click, approve permission prompts, navigate Android settings, and interact with banking apps. Detection should focus on behavior rather than relying on signatures alone. High-risk indicators include:
  
  • An unknown app monitoring the foreground app.
  • Automated clicks on permission dialogs or system settings.
  • Rapid, repeated taps on Android settings screens.
  • Attempts to read UI elements in banking, e-wallet, or cryptocurrency apps.
  • Transparent overlays appearing over financial apps.
  • Full-screen WebView overlays mimicking login, transaction, PIN, or lock screens.
  • Fake "SystemUpdate" screens masking background activity.
    Banks, cryptocurrency platforms, and payment providers should integrate runtime protection or anti-fraud telemetry into their apps. If an overlay is detected during login, PIN entry, transaction approval, or wallet access, the app should raise the risk score, block input, terminate the session, or require step-up verification through a trusted channel.

• Disable or Monitor Wireless Debugging and ADB Abuse:
  ToxicPanda 2.0 introduces automated flows to enable Developer Options, turn on Wireless Debugging, capture the pairing code, and pair with the local ADB daemon. This can give the malware shell-level access, allowing it to grant itself permissions, bypass restrictions, and strengthen persistence. Mitigations should include:
  
  • Keep Developer Options disabled on user devices.
  • Keep Wireless Debugging disabled unless explicitly required.
  • Block or restrict ADB and Wireless Debugging through enterprise device policy.
  • Alert when Developer Options are unexpectedly enabled.
  • Detect automated navigation to developer settings.
  • Flag attempts to pair with ADB over localhost.
  • Treat sudden enabling of Wireless Debugging as a serious compromise signal.
    This is especially important for devices running Android 11 and later, which support Wireless Debugging.

• Disrupt Command-and-Control Communications:
  ToxicPanda 2.0 uses HTTPS followed by persistent WebSocket communication for real-time control. Although the malware encrypts C2 messages with AES-ECB, defenders can still detect suspicious network patterns and known infrastructure. Recommended controls include:
  
  • Block known ToxicPanda C2 domains, IPs, WebSocket endpoints, and AWS-hosted delivery paths.
  • Monitor persistent encrypted WebSocket sessions from mobile devices to suspicious infrastructure.
  • Apply mobile web/content filtering on managed devices.
  • Use DNS, proxy, and network telemetry to identify anomalous mobile outbound communications.
  • Cut off C2 access from infected devices to prevent command execution and data exfiltration.
    Network blockingalone is not sufficient, but it can reduce the attackers' control and limit thetheft of credentials, PINs, installed-app data, and device information.
    Network blocking alone is not sufficient, but it can reduce the attackers' control and limit the theft of credentials, PINs, installed-app data, and device information.
• Enterprise Response and Hardening:
  Enterprises should adopt layered mobile security rather than relying only on signature-based malware detection. Because ToxicPanda 2.0 dynamically changes its targets and abuses legitimate Android features, behavioral detection is critical. Enterprise controls should include:
  
  • Deploy Mobile Threat Defense on managed Android devices.
  • Enforce app allowlisting and block unknown APKs.
  • Restrict sideloading and installation from unknown sources.
  • Limit Accessibility Service use to approved apps.
  • Disable Developer Options, ADB, and Wireless Debugging wherever possible.
  • Block unauthorized VPN profiles.
  • Monitor Device Administrator grants.
  • Detect attempts to bypass OEM auto-start and battery optimization controls.
  • Apply web/content filtering to malicious cloud-hosted payloads and C2 traffic.
  • Isolate compromised devices from enterprise resources until they have been cleaned or reset.

‍

IoCs (Indicator of Compromise)

For the full list offile IoCs, please refer to: https://github.com/Zimperium/IOC/tree/master/2026-08-ToxicPanda

C2

https://cctvv2.com/panel
https://www.v17001.com/panel
https://www.w17907.com/panel
https://g8688808.com

Phishing websites:

http://xcmtxc1oam1.s3.ap-south-1.amazonaws.com
https://ui920fht4m1.s3.mx-central-1.amazonaws.com/
https://googleplaydown.com/dUyFpz0Ai7Sp
https://api.telegram.org/file/bot8331125434:AAEsxWq7_xZWUjN0IFLO3fTU54ZCBnZS4YI/documents/file_22526.apk
https://api.telegram.org/file/bot8978201863:AAG4vnsJVOAbABfF6dXhhM8YJ14pd5LaxVw/documents/file_1389.apk
https://osy4u8pmu.s3.ap-southeast-1.amazonaws.com/
https://ejjsi5fbl.s3.ap-southeast-1.amazonaws.com/
https://svhc5arco.s3.ap-southeast-1.amazonaws.com/

References

• The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile
• Godfather Evolves With Advanced On-Device Virtualization Capabilities
• GhostSpy Web-Based Android RAT : Advanced Persistent RAT with Stealthy Remote Control and Uninstall Resistance
• ToxicPanda: a new banking trojan from Asia hit Europe and LATAM
• ToxicPanda Android Banking Trojan