CyberNew CyberNew
Ransomware & Malware Dark Reading 1 month ago

ToxicPanda Banking Trojan Matures Into Enterprise Threat

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"An Android banking Trojan has resurfaced with a new variant that demonstrates a significant evolution toward full device compromise and persistent access, putting at risk not only mobile users but also the enterprise resources accessed from those devices. ToxicPanda 2.0 expands substantially on its predecessor, adding 167 remote commands and broadening its targeting from 16 financial institutions..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

An Android banking Trojan has resurfaced with a new variant that demonstrates a significant evolution toward full device compromise and persistent access, putting at risk not only mobile users but also the enterprise resources accessed from those devices.

ToxicPanda 2.0 expands substantially on its predecessor, adding 167 remote commands and broadening its targeting from 16 financial institutions to 349 banking, e-wallet, and cryptocurrency applications, according to recent research from Zimperium zLabs. The Trojan also adds more sophisticated techniques for compromising Android devices, including privilege escalation and shell-level access through Android's Wireless Debugging and Android Debug Bridge (ADB), as well as capabilities designed to maintain long-term persistence on infected devices.

ToxicPanda first emerged in November 2024, when it was observed taking over Android devices and facilitating fraudulent mobile banking transactions in Latin America, Italy, Portugal, and Spain. Its expansion into 16 countries and the addition of significantly more functionality indicate a more mature and capable threat than the initial version researchers encountered.

Related:Video Call Exploit Chains Two Flaws in Unisoc Modems

Overall, the updated version "demonstrates a significant expansion in targeting scope and capabilities," Zimperium zLabs researcher Vishnu Pratapagiri wrote in the report.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →