ToxicPanda 2.0 Targets 349 Financial Apps and Uses ADB to Take Control of Android Devices

A Much Broader Campaign Than Its Predecessor

On August 22, 2026, Zimperium zLabs detailed ToxicPanda 2.0, a new version of the Android malware that dramatically expands its financial targets. The previous variant was associated with 16 banking applications; the current version targets 349 apps across banks and financial services in 16 countries.

The scope also includes cryptocurrency-related applications. The malware does more than steal credentials: it can control the interface, automate transactions, modify settings, and maintain access to the device.

The campaign has not been attributed to a specific criminal group. No CVE identifiers have been reported because the attack does not rely on a new software vulnerability, but rather on the abuse of legitimate Android features.

Disguised Installation and Play Protect Evasion

ToxicPanda 2.0 presents itself as a legitimate application and uses a fake installation screen. During this stage, it requests VPN permissions, which are then abused to interfere with Google Play Protect communications.

The actual payload is encrypted and hidden in the application’s asset files. Once installed, the malware attempts to conceal its activity and obtain additional operational capabilities.

The infection chain abuses several components normally intended for administrative, accessibility, or development purposes:

• Android Accessibility Service;
• Wireless Debugging;
• Android Debug Bridge, or ADB;
• device management APIs;
• Device Administrator privileges.

Abusing accessibility is central to the attack. The service allows the malware to read elements displayed on the screen, identify buttons, and interact with applications as a user would.

Wireless Pairing Opens a Path to the Shell

The most significant element of the new analysis is the automation of Android Wireless Debugging. ToxicPanda 2.0 can open Developer Options by simulating the seven taps on the build number, then enable wireless debugging.

Using Accessibility Service, the malware reads the six-digit pairing code from the display. It then completes the cryptographic pairing process and establishes an ADB connection, attempting to conceal the activation of Developer Options from the user.

This step significantly expands the level of control available. With ADB, ToxicPanda can execute commands without relying on the standard authorization prompts visible to the user. It can also:

• grant itself additional permissions;
• reduce restrictions on background activity;
• activate Android components without clear user consent;
• strengthen persistence;
• execute shell-level commands.

The same click automation is adapted to manufacturers’ customized interfaces. Zimperium cites Xiaomi, Samsung, Huawei, and other modified Android versions, meaning the malware can handle different dialogs and confirmation prompts depending on the device.

Credentials, Unlock Codes, and Financial Fraud

ToxicPanda identifies the application currently in use and compares it with its list of 349 targets. When it recognizes a financial service, it can display a fake login screen to capture credentials.

The operators also have access to more invasive techniques. A transparent, invisible overlay can intercept taps, PINs, and other input, while access to interface elements allows the malware to steal whatever is displayed on the screen.

The malware can also display a replica of the Android lock screen. It thereby attempts to capture device PINs, patterns, and passwords. The unlock code may allow attackers to maintain or regain access after the initial infection stage.

Remote control enables the manipulation of sessions in banking and cryptocurrency apps. Potential uses include automating transactions, changing settings, and conducting fraud directly from the compromised device.

167 Commands and New Operational Capabilities

ToxicPanda 2.0 supports 167 remote commands. Several features that an earlier Cleafy analysis had deemed nonfunctional are operational in the new version.

Documented capabilities include:

• automating manufacturers’ authorization prompts;
• requesting Device Administrator privileges through a fake “system service” notification;
• remotely resetting the lock-screen password through legitimate Android APIs;
• loading an attacker-controlled page in a full-screen overlay;
• remotely controlling and monitoring the display;
• executing commands through the available instruction set.

These capabilities combine surveillance, data theft, and device administration. The attacker can modify the device without introducing an exploit specific to a particular Android version.

AWS Makes Infrastructure Blocking More Difficult

The observed samples are distributed using buckets hosted on Amazon AWS. This marks a shift from the more improvised infrastructure associated with earlier campaigns.

Using legitimate cloud services makes simple IP address blocking less effective. Blocking entire AWS ranges could affect corporate traffic and trusted applications without automatically distinguishing malicious content.

The source does not disclose enough detailed technical indicators to support universal infrastructure blocking. Defenders must therefore correlate multiple signals: suspicious applications, abnormal authorization requests, connections to unusual buckets, and changes to device settings.

What to Check on Android Devices

No specific patch or fix for an Android vulnerability has been identified. It is also unknown whether ToxicPanda 2.0 is included in CISA’s KEV catalog or whether remediation deadlines have been established.

Organizations should monitor unexpected activation of Accessibility Service, Wireless Debugging, ADB, and Device Administrator. Particular attention should be paid to the automatic opening of Developer Options and attempted wireless pairing.

The following should also be investigated:

• VPN requests from untrusted applications;
• unusual or fake installation screens;
• attempts to interfere with Google Play Protect;
• overlays displayed over banking applications;
• fake lock screens or full-screen pages;
• unauthorized changes to passwords, permissions, and background activity;
• unexpected activation of Android components;
• connections to suspicious AWS buckets.

Static signatures alone may not be sufficient. ToxicPanda 2.0 uses standard operating system tools and turns them into channels for reading the screen, authorizing operations, and gaining remote control. The priority is therefore to identify abnormal combinations of legitimate behaviors, not merely search for a known file.