ToxicPanda 2.0 Abuses VPN to Block Google Play and Control Android Smartphones

Malware Expands Its Attack Surface

ToxicPanda has been updated to version 2.0, with a significantly broader targeting capability than previous variants. Zimperium’s analysis describes malware capable of targeting 349 banking, financial, crypto, and e-wallet applications across 16 countries.

The recently observed campaign uses Amazon AWS-hosted buckets to distribute malicious components. Complete details about the infection chain and a list of vulnerable Android versions have not been disclosed. However, ToxicPanda abuses features available in the operating system and compatible devices, including Wireless Debugging introduced in Android 11.

The new version supports 167 remote commands. This allows operators to modify the infection’s behavior after compromise, dynamically update targets, and issue device-specific instructions.

The primary objectives are to steal authentication data and control financial applications. The malware can exfiltrate credentials, PINs, passwords, and unlock patterns, as well as intercept what the user types or selects on the screen.

The VPN Permission Becomes an Attack-Defense Mechanism

One of ToxicPanda 2.0’s most significant features is its abuse of the VPN Service permission. The malware creates a local VPN interface and routes the smartphone’s traffic through it.

The feature is not necessarily used to send all traffic to a remote server. In this case, it is mainly used to filter and block communications directed to Google Play and Google Play Services.

The block is applied before the payload is extracted and installed. As a result, the device may lose or delay communications related to application verification, updates, Play Protect, and other security features in the Google ecosystem.

The user may see an apparently legitimate request to activate a VPN. If permission is granted, ToxicPanda gains a privileged position in the local traffic path and can prevent Google’s checks from reaching the device correctly.

After this stage, the malware also requests Accessibility Service access. This service is designed to assist people with disabilities, but it is frequently abused by malware because it can read interface elements, simulate interactions, and press buttons on the user’s behalf.

Invisible Overlays and Fake Screens Target PINs and Passwords

ToxicPanda includes separate modules for targeting financial applications. One of them targets 140 banking and crypto apps and maintains a dynamically modifiable target list.

The malware can overlay windows on top of legitimate applications. These overlays may be difficult to detect and can capture touch input while the victim believes they are using their bank, an exchange, or an e-wallet.

This technique enables the interception of credentials, personal codes, and other information entered during login or a transaction. The original application may remain visible in the background, making the interface replacement less obvious.

ToxicPanda can also recreate Android’s lock screen. The victim may therefore enter PINs, passwords, or unlock patterns into a window controlled by the malware, believing they are authenticating on the device.

Some analyzed samples also display fake system-update screens. The fake update may help justify abnormal behavior, delay the user’s response, and conceal the malware’s activity while new privileges are granted.

The impact extends beyond credential theft. The combination of overlays, Accessibility Service access, and traffic control can allow attackers to manipulate the workflows of numerous financial applications.

Wireless Debugging Abuse Strengthens Persistence

The most advanced capability observed in ToxicPanda 2.0 involves Android Debug Bridge, or ADB. This tool enables shell commands to be executed on the device; Wireless Debugging allows it to be used over a Wi-Fi network without a USB connection.

By abusing Accessibility Service, the malware can open Developer Options, enable Wireless Debugging, retrieve the six-digit ADB pairing code, and identify the communication port. It can then connect to the smartphone’s local ADB service.

Once it obtains shell-user privileges, ToxicPanda executes commands through the ADB daemon. This allows it to bypass some standard Android consent prompts, grant additional permissions, and activate components without necessarily displaying the usual warnings.

ADB can also be used to reduce the effectiveness of mechanisms that terminate background processes. The malware thereby reinforces its persistence and increases the likelihood of remaining active after a reboot or during everyday device usage.

The autoBoot remote command identifies the smartphone manufacturer and opens OEM-specific settings for auto-start or power management. The procedure is intended to disable or bypass restrictions that limit background processes.

Xiaomi, OPPO, Vivo, Samsung, and Huawei devices are referenced. Settings may vary across manufacturers and models, but the principle is the same: keep the malware active by preventing the system from shutting it down to reduce battery consumption.

Wireless ADB abuse is not unique to ToxicPanda. Group-IB described a similar mechanism in the latest version of RedHook, indicating that this technique may become increasingly common in Android campaigns.

How to Check a Potentially Compromised Device

Zimperium has published on GitHub a list of indicators of compromise associated with the latest version of ToxicPanda. The first step is therefore to compare the IoCs with events and data available from corporate or personal devices.

Users should pay close attention to unexpected requests to activate a VPN, grant Accessibility Service access, or enable Developer Options. Wireless Debugging enabled without the user’s explicit consent is also a signal that should be investigated.

It is also advisable to check for unusual overlays, update screens appearing outside the manufacturer’s normal update cycle, and repeated requests for PINs or credentials. Anomalies in auto-start settings and power management deserve the same attention.

No specific remediation measures or official removal procedure associated with ToxicPanda 2.0 have been disclosed. In cases of suspected compromise, monitoring the IoCs and collecting the described indicators are the actions directly supported by the available information.

The operational risk is high for users of banking apps, crypto services, and e-wallets. No CVSS score has been assigned because this is not the description of a single software vulnerability, but rather a malware campaign combining permission abuse, interface interception, and ADB-based persistence.