ToxicPanda 2.0 Android Malware Expands Global Banking and Cryptocurrency Targeting

ToxicPanda 2.0 Enhancements

Cybersecurity researchers have identified an updated version of the Android malware, ToxicPanda (also known as TgToxic), which includes significant enhancements. This new iteration features a set of 167 remote commands and has expanded its global targeting footprint. The malware has been active since at least July 2022.

Expanded Targeting and Capabilities

ToxicPanda 2.0 now targets over 140 banking and cryptocurrency applications for PIN harvesting, a substantial increase from the previous version's 16 targets. It abuses Android's accessibility service to steal UI elements and employs an overlay-based credential theft mechanism against 349 financial institutions across 16 countries. The malware also siphons lock screen credentials using fake overlays and introduces an automated click-based mechanism to exploit Android Wireless Debugging via ADB for privilege escalation and shell-level access.

New Functionalities and Evasion Techniques

The updated malware includes functionalities such as prompting victims to grant Device Administrator privileges and overwriting the device's local lock screen PIN with an attacker-defined value. It can also profile infected devices to determine the OEM vendor and take steps to exempt itself from battery optimization policies, ensuring uninterrupted background execution. ToxicPanda 2.0 establishes a bidirectional WebSocket communication channel with its command-and-control (C2) server to receive commands and exchange data.

Distribution Method Shift

Researchers note a shift in the distribution methods for ToxicPanda 2.0. Samples of the malware are now being delivered through Amazon AWS-hosted buckets, indicating that the attackers are leveraging cloud infrastructure for malware delivery. This change in distribution strategy highlights an evolving approach by threat actors to deploy their malicious software.