zLabs identified ToxicPanda 2.0, an updated Android banking Trojan that greatly expands its command set, targeting scope, and fraud capabilities, including PIN theft, lock-screen credential harvesting, and abuse of Android Wireless Debugging for shell access. The campaign also shifts delivery to Amazon AWS-hosted buckets and targets 349 financial apps and 140+ banking and cryptocurrency apps across 16 countries. #ToxicPanda #AmazonAWS #AndroidAccessibilityService #ADB #SPAKE2
Keypoints
- ToxicPanda 2.0 is an updated Android banking Trojan with 167 remote commands and significantly expanded capabilities.
- The malware now targets more than 140 banking and cryptocurrency apps for PIN theft and 349 financial institutions for overlay-based credential theft.
- It abuses Android Accessibility Service to capture UI elements, automate actions, and support fraudulent activity.
- The malware can abuse Android Wireless Debugging (ADB) to obtain shell-level access and escalate privileges on infected devices.
- It can steal lock-screen credentials by overlaying spoofed screens that mimic the native Android lock screen.
- Distribution has shifted to Amazon AWS-hosted buckets, indicating use of cloud infrastructure for malware delivery.
- Several previously unimplemented commands are now functional, including OEM permission automation, device administrator exploitation, transparent overlays, and auto-start bypass logic.
MITRE Techniques
- [T1113 ] Screen Capture – The malware abuses Accessibility Service to steal UI content and screen elements from targeted apps (‘steal every UI element on the screen’).
- [T1518.001 ] Security Software Discovery – It enumerates installed applications and sends package names/icons to identify banking and financial apps (‘enumerates all applications installed on the victim’s device’).
- [T1056.001 ] Keylogging – The malware captures touches, PINs, patterns, and passwords entered by victims through overlays and touch capture (‘capture touch that the victims entered’).
- [T1548 ] Abuse Elevation Control Mechanism – It abuses Wireless Debugging/ADB and Device Administrator prompts to gain higher privileges (‘get shell user capabilities’, ‘grant Device Administrator privileges’).
- [T1021.006 ] Remote Services: Windows Remote Management – Not applicable; no matching Windows remote service technique is described.
- [T1090 ] Proxy – The malware uses a persistent WebSocket channel to relay commands and data between device and C2 (‘persistent WebSocket connection’).
- [T1036 ] Masquerading – It disguises malicious activity with fake installer screens, fake system updates, and spoofed login/lock screens (‘fake installation interface’, ‘deceptive “system update”‘).
- [T1566 ] Phishing – It uses HTML overlays that imitate legitimate banking and transaction screens to trick victims into entering credentials (‘replicate the appearance of the genuine application’s login’).
- [T1140 ] Deobfuscate/Decode Files or Information – The dropper decrypts and extracts the payload from the app’s assets folder (‘decrypts and extracts the actual payload’).
- [T1053 ] Scheduled Task/Job – Not applicable; no task scheduling behavior is described in the article.
- [T1556.002 ] Modify Authentication Process: Password Filter DLL – Not applicable; no password filter mechanism is described.
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – It blocks communication with Google Play/Google Play Services and bypasses background restrictions and OEM power controls (‘block network communication’, ‘neutralize OS background restrictions’).
- [T1406 ] Input Capture – It uses overlays and Accessibility Service to intercept entered PINs and credentials (‘PIN harvesting process’, ‘capture touch’).
- [T1647 ] Web Service – The malware loads attacker-controlled content inside a full-screen WebView for phishing (‘remotely loads an attacker-controlled URL’).
Indicators of Compromise
- [Domain / URL ] C2 and malicious content delivery infrastructure – Amazon AWS-hosted buckets, attacker-controlled URL
- [Network Protocol / Port ] Remote command-and-control and pairing channels – HTTPS, WebSocket, 127.0.0.1, and other dynamic pairing port
- [File / Path ] Malware payload and fake content sources – application assets folder, resources/, WebView-loaded HTML templates
- [Application / Package Targets ] Financial app targeting lists – 349 banking/financial/e-wallet/cryptocurrency applications, 140+ banking and crypto apps
- [String / Command Names ] Malware feature and control identifiers – v2, replacePinTargets, catAllViewSwitch, admSet, admPwd, transparent, autoBoot
- [IP Address ] Local ADB pairing endpoint – 127.0.0.1
- [Crypto / Auth Data ] Wireless Debugging pairing artifacts – 6-digit PIN, SPAKE2 pairing code, dynamic connection port