ToxicPanda 2.0: The Android Banking Trojan Now Targeting Corporate Identity

A banking trojan created to drain accounts in Latin America and Europe has transformed into a far more ambitious threat. ToxicPanda 2.0, the new variant analyzed by researchers at Zimperium zLabs (author Vishnu Pratapagiri), no longer limits itself to intercepting banking credentials: it aims to take full control of the Android device, persist over time, and use the smartphone as a springboard to corporate resources. The research numbers tell the story of this evolution: 167 new remote commands, a target that has expanded from 16 financial institutions to 349 applications including banking, electronic wallets, and cryptocurrencies, and observed presence in 16 countries. The first appearance of ToxicPanda dates back to November 2024, when the malware operated in Latin America, Italy, Portugal, and Spain. Today, the 2.0 variant changes scale and ambitions.

From Latin America to Enterprise Devices: What Changed

In November 2024, ToxicPanda was a classic Android banking trojan: it took control of the infected device to facilitate fraudulent transactions, focusing on a limited number of financial institutions. The newly discovered version has dramatically expanded its reach.

The most evident leap is in the number of targeted applications: from 16 to 349. It is no longer just banking apps, but also electronic wallets and cryptocurrency wallets. This means the malware doesn’t only seek the victim's bank account, but every type of digital value accessible from the phone, including keys for decentralized funds.

But the geographic expansion is equally significant. While the first version hit four countries, variant 2.0 has been observed in 16. Which countries were not disclosed, but the diversification suggests a campaign distributed on a larger scale, likely facilitated by cloud infrastructure that is difficult to block.

Researchers at Zimperium zLabs identified this evolution by analyzing the code and command and control servers. The addition of 167 remote commands is a clear indicator: ToxicPanda is no longer a simple tool to steal passwords, but a modular platform ready to execute new functions depending on the context.

How It Steals the PIN: The Lock Screen Overlay

One of the most dangerous new behaviors is the use of a lock screen overlay. When the victim unlocks the phone, the malware superimposes a fake lock screen that records the PIN or pattern entered. The stolen data, stored in plaintext or transferred to the attacker's server, allows bypassing the first protection barrier of the device.

But stealing the PIN is not an end in itself. ToxicPanda 2.0 also has the privileges necessary to reset the device password. In combination, these two capabilities allow the attacker to obtain the strongest identity anchor that exists on a smartphone: full control of the operating system, with the ability to authenticate as the legitimate owner.

This combination is devastating because the compromised phone is often the same device that approves multi-factor authentication push requests, stores passkeys, and hosts work apps. If the malware manages to enter the device as a privileged user, all connected accounts become accessible.

The Backdoor: Wireless Debugging and ADB

The most significant technical step concerns the abuse of Android debugging features. Android 11 introduced Wireless Debugging, a feature designed for developers that allows connecting the phone to a computer without a USB cable. ToxicPanda 2.0 turns it into a backdoor.

The mechanism works as follows. Through accessibility services, the malware enables developer options on the device. Then it activates Wireless Debugging, extracts the temporary pairing code required to pair an ADB (Android Debug Bridge) client, and completes the pairing with the phone's ADB service. At this point, the attacker gains shell-level access.

From there, it's game over: they can execute direct commands on the device, grant themselves additional permissions, weaken operating system restrictions, enable system components, and establish persistence. In practice, the malware turns the phone into a remotely controlled endpoint, with the same powers as an administrator.

This attack exploits a legitimate and necessary feature for developers, but one that should never be active on most corporate devices. The problem is that its activation is silent: it generates no visible notifications to the average user, and is often not monitored by management systems.

Distribution via AWS: Legitimate Cloud as a Vector

An element that complicates detection is the choice of distribution infrastructure. ToxicPanda 2.0 is served through buckets hosted on Amazon Web Services. These are not bulletproof servers or suspicious domains: it is legitimate cloud infrastructure, with valid certificates and a clean reputation.

This choice makes it harder to block malware downloads through blacklists or reputation-based firewalls. AWS buckets can be created, renamed, and recycled quickly, and traffic to them is indistinguishable from traffic to legitimate corporate cloud services.

For a company, this means that a simple policy of blocking malicious domains is not enough. Deeper control is needed, capable of inspecting the content of downloaded files and detecting anomalous behavior on the device, regardless of origin.

Impact on Digital Identity and Enterprise Resources

The direct economic damage to the 349 targeted apps is only the tip of the iceberg. Persistent control of the device allows the attacker to manipulate authentication, steal credentials, alter applications, and use the endpoint as a springboard to other corporate resources.

If the compromised phone is registered in the company's identity systems, the consequences can be severe. The attacker can intercept MFA push requests, use passkeys stored on the device, access corporate email, shared documents, and SaaS applications. The phone becomes a universal key.

Zimperium emphasizes that traditional signature-based security layers are no longer sufficient. Variant 2.0 is designed to evade static detection and act in depth, exploiting operating system features that are rarely checked.

Bradley Smith, SVP and deputy CISO at BeyondTrust, warns especially about the combination of PIN theft and device password reset. "The attacker obtains the identity anchor," he explains, "and with it access to all accounts that depend on it." In short, the risk is not a single bank account: it is the entire digital identity of the victim and their company.

What Companies Can Do: Monitor Signals That Already Exist

The mitigations proposed by Zimperium focus on comprehensive, multi-layered protection capable of interrupting the malware at multiple stages of the attack chain. There is no single patch or configuration that solves everything: a combination of technical and organizational controls is needed.

Bradley Smith of BeyondTrust indicates three concrete actions. The first is to block sideloading on devices registered in corporate identity systems: ToxicPanda 2.0 does not come from official stores, so preventing installation of apps from unknown sources drastically reduces the initial risk.

The second is to treat the granting of accessibility services as privileged access events. On Android, accessibility services are a powerful tool that allows an app to read and manipulate the screen and interactions. ToxicPanda exploits them to enable debugging and steal credentials. Every grant of these permissions should be logged, verified, and revoked if not justified.

The third is to generate alerts when Developer Options or Wireless Debugging are activated on managed mobile devices. These signals are already visible on most MDM (Mobile Device Management) platforms but are rarely monitored. A timely alert can stop the attack before the malware completes ADB pairing and obtains shell access.

In summary, ToxicPanda 2.0 is not a threat that can be solved with an update. It is an attack that exploits legitimate system features and trusted cloud infrastructure. Companies must enable controls they already possess but often ignore, and treat mobile devices as critical endpoints, just like servers.