ToxicPanda 2.0 Hijacks Wireless ADB, Hits 349 Bank Apps

Security researchers have uncovered a significantly upgraded version of the ToxicPanda Android banking trojan that now targets 349 financial applications across 16 countries, blocks Google Play at the network level, and hijacks Android's wireless debugging feature to seize shell-level control of infected devices. Mobile security firm Zimperium's zLabs team identified the new variant, which it has designated ToxicPanda 2.0, and published its findings in a detailed technical report.

The malware, first documented by Cleafy in 2024 as a threat that primarily hit banking customers in Europe, has evolved into a far more capable and aggressive tool for financial fraud. The most immediately striking change is the scale of ToxicPanda's target list. Earlier versions of the malware focused on a relatively narrow set of 16 banking applications, largely concentrated in Italy, Portugal, Spain, and a handful of Latin American countries. The new variant expands that list more than twentyfold.

It now supports phishing overlays for 349 banking, financial, e-wallet, and cryptocurrency applications spread across 16 countries. Once installed on a device, the malware quietly enumerates all installed applications, sending package names and icons to its command-and-control (C2) server so operators can identify which financial apps are installed. When a victim opens one of the targeted apps, ToxicPanda requests a matching malicious HTML overlay from its C2 infrastructure and displays it over the legitimate app.

These overlays are designed to closely mimic genuine login and transaction screens, tricking victims into entering credentials, PINs, and other sensitive data that is then exfiltrated to attackers. Alongside the overlay system, the malware runs a separate PIN-harvesting module aimed specifically at more than 140 banking and cryptocurrency apps. This component deploys an invisible, transparent overlay over targeted apps to capture the exact touch inputs a victim makes while entering a PIN.

The module can be updated remotely through a dedicated command that lets operators swap in new target packages and keywords on the fly. ToxicPanda 2.0 also introduces a new evasion trick built around Android's VPN framework. Rather than requesting dangerous-sounding permissions up front, the malware first asks victims to grant VPN service privileges via a fake installation screen rendered in a WebView.

Once granted, this creates a local VPN interface that gives the malware control over network traffic passing through the device. With that control in place, the malware blocks communication with Google Play and Google Play Services before extracting and installing its actual malicious payload, which is stored encrypted in the app's assets folder.

Cutting off Google Play at the network layer interferes with app verification checks, update processes, and Play Protect communications; the very mechanisms designed to flag and remove malicious software. Only after the payload is installed does the malware request Accessibility Service permissions, the gateway that allows it to carry out the bulk of its remote-control functionality.

Turning the Phone Into Its Own ADB Client

Perhaps the most notable technical addition in this release is ToxicPanda's automated abuse of Android's Wireless Debugging feature, introduced in Android 11 to let developers run Android Debug Bridge (ADB) commands over Wi-Fi without a USB cable. Using the Accessibility Service it already controls, the malware essentially turns the infected phone into its own ADB client, executing a multi-phase sequence entirely on-device:

• It first checks whether Developer Options is enabled and, if not, opens the device info settings page and simulates 7 rapid taps on the build number to unlock developer mode.
• It then navigates to the wireless debugging settings and toggles the feature on, then triggers the device's pairing dialog and scrapes the six-digit pairing code and connection port directly from the screen.
• Using that stolen code, it authenticates a cryptographic key exchange with the local ADB daemon over the loopback interface and establishes a TLS-encrypted pairing session.

Once paired, the malware obtains shell-level (UID 2000) privileges, well beyond what a standard Android app can normally access, though short of full root. Zimperium researchers noted that once shell access is secured, the malware runs high-privilege commands through the ADB daemon and "bypasses standard Android runtime consent prompts to grant itself broad permissions," while also neutralizing background restrictions and reinforcing its own persistence.

This is not an isolated development. Wireless ADB abuse is becoming "a growing trend among Android malware," as BleepingComputer put it, with other malware authors adopting similar techniques in their own tools. Group-IB recently documented a comparable wireless ADB abuse method in the latest version of the RedHook malware, which tricks victims into granting Accessibility permissions, then enables Developer Options and Wireless Debugging on its own, and finally deploys a Shizuku-based framework to run privileged shell commands.

RedHook's current build supports 53 remote commands and, according to Group-IB, retains remote-access trojan capabilities such as screen streaming, keystroke interception, and automated UI manipulation. The full ToxicPanda 2.0 command set, published by Zimperium alongside its indicators of compromise, now spans 167 remote commands; up sharply from the previous version, several of which Cleafy had previously flagged as present in the code but not yet functional. Notable capabilities include the following:

• admPwd and admSet – abuse Device Administrator privileges to force-reset the device's screen lock PIN or password, potentially locking the legitimate owner out entirely, after luring the victim with a prompt claiming a "system service requires administrator privileges."
• catAllViewSwitch – automatically detects and interacts with manufacturer-specific permission dialogs and battery-optimization prompts across a wide range of Android OEM interfaces, tapping buttons such as "Allow" or their localized equivalents without user input.
• autoBoot – identifies the device manufacturer using the Build.MANUFACTURER value and opens the corresponding vendor-specific power-management settings, such as Xiaomi's MIUI Security Center or Samsung's Smart Manager, then uses Accessibility Service to whitelist itself and dodge aggressive battery-saving process kills.
• lockAdvance and related lock commands – display a full-screen overlay that convincingly imitates the native Android lock screen, capturing the PIN, pattern, or password a victim enters to unlock their device.
• transparent – loads an attacker-specified URL inside a full-screen WebView for additional phishing or deception campaigns.

Some infected devices have also been observed displaying fake "system update" screens rendered from local HTML templates, a tactic that conceals the malware's background activity from the victim while it carries out fraudulent transactions or extracts data. Zimperium noted a shift in how the malware reaches victims, with ToxicPanda 2.0 samples now distributed via buckets hosted on Amazon Web Services rather than the infrastructure used in earlier campaigns.

The malware communicates with its command-and-control panel, now branded internally with a "v2" label, over a persistent WebSocket connection established after an initial HTTPS handshake, with traffic secured using AES encryption in ECB mode and a key embedded directly in the app's source code. Because ToxicPanda relies on victims manually granting VPN, Accessibility, and Device Administrator permissions to a sideloaded app, the most effective defense remains avoiding installation sources outside the Google Play Store.

Users should treat any app requesting Accessibility Service access, especially one arriving via a link, SMS message, or third-party APK, with heavy suspicion, since that permission is the gateway the malware uses to unlock nearly every other capability described above. Researchers also recommend keeping Google Play Protect enabled, watching for unexpected prompts to enable Developer Options or Wireless Debugging, and periodically reviewing which apps hold Device Administrator or Accessibility privileges in device settings.

Anyone who notices unusual overlays, unexplained crashes, or a suddenly unresponsive lock screen should disconnect from Wi-Fi and mobile data, then contact their bank immediately. Zimperium has published the full list of indicators of compromise associated with ToxicPanda 2.0 in a public GitHub repository, giving enterprise security teams and mobile threat defense products a way to detect and block the malware's infrastructure.