ToxicPanda 2.0 Android banking Trojan – Steals Lock PINs

The ToxicPanda 2.0 Android banking Trojan just got a major upgrade, and security researchers are not thrilled about it. Zimperium’s zLabs threat research team disclosed the new variant on August 19, revealing malware that no longer just steals login credentials.

It now automates entire device takeovers, expands its target list to hundreds of apps, and hides its tracks using legitimate Android features. If your phone holds a banking app or a crypto wallet, this one is worth understanding.

What Is ToxicPanda 2.0 Malware?

ToxicPanda 2.0 is the latest version of an Android banking Trojan first spotted in October 2024. Zimperium’s zLabs team says the new variant introduces 167 remote commands, giving attackers granular control over an infected device. Rather than a simple credential-stealing app, ToxicPanda 2.0 behaves more like a remote access toolkit built specifically to drain bank accounts and crypto wallets.

How ToxicPanda 2.0 Differs From the Original ToxicPanda Trojan

The original ToxicPanda targeted roughly 16 banking apps, mostly across Italy, Spain, Portugal, and Latin America. ToxicPanda 2.0 blows past that scope entirely, now targeting 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries. Several commands that researchers previously flagged as unfinished in the original version are now fully functional, turning half-built features into working attack tools.

Android’s own update cycle plays a role in how exposed devices are to threats like this. Our recent coverage of the Android 17 QPR2 features and beta rollout breaks down what Google is changing under the hood this year.

Which Banking and Crypto Apps Are at Risk?

According to Infosecurity Magazine, most of the 349 targeted financial institutions sit in Pakistan, South Africa, Mexico, Nigeria, and India. The malware also runs a separate PIN-theft mechanism aimed at more than 140 banking and cryptocurrency apps specifically. When a victim opens a targeted app, ToxicPanda 2.0 quietly requests a matching fake overlay from its command server and slides it on top of the real login screen.

New Techniques: ADB Abuse, Lock Screen Theft & Persistence

This is where ToxicPanda 2.0 gets genuinely inventive. The malware automates Android’s Wireless Debugging feature, tapping through developer settings on its own to pair with the device’s ADB daemon and grab shell-level access. It can also reset a victim’s lock screen PIN using Android’s device administrator tools, and it steals lock credentials outright with a fake overlay disguised as the real lock screen.

To stick around, ToxicPanda 2.0 studies the phone’s manufacturer and dodges the battery optimization tools built by Xiaomi, Oppo, Vivo, Samsung, and Huawei that would normally kill background apps. Some samples even display a fake system update screen to hide what is happening underneath. The malware’s newest delivery method uses Amazon AWS-hosted storage buckets, a sign attackers are leaning on legitimate cloud services to dodge detection.

Fake update screens are an old trick with new teeth, and infrastructure-level scares are not limited to phones. Our report on the Taiwan internet blackout air raid drill looks at a very different kind of digital disruption.

Expert Reaction From Zimperium zLabs

“ToxicPanda 2.0 demonstrates how quickly mobile malware continues to evolve,” said Nico Chiaraviglio, Chief Scientist at Zimperium zLabs, in the company’s official announcement. “Rather than simply stealing credentials, this malware automates device compromise, expands financial targeting on a global scale, and abuses legitimate Android features.” BeyondTrust deputy CISO Bradley Smith offered a blunter summary to Infosecurity Magazine, arguing that ToxicPanda 2.0 does not break Android so much as it operates it.

How to Protect Your Android Device From ToxicPanda 2.0

Security experts recommend blocking app sideloading, especially on devices tied to work accounts. Treat any accessibility service permission request as a red flag worth double-checking before granting it. Keep an eye on whether developer options or wireless debugging switch on without your input, since that is one of ToxicPanda 2.0’s signature moves. Sticking to the Google Play Store and skipping APKs from random links cuts off the malware’s most common entry point.

Device security habits matter across platforms, not just Android. For a look at how the other side handles new hardware, check our coverage of the iPhone 18 Pro release and confirmed upgrades.

The Bottom Line

The ToxicPanda 2.0 Android banking Trojan is a reminder that mobile malware keeps catching up to the defenses built against it. Zimperium’s research gives banks, security teams, and everyday users a clearer picture of what to watch for, from fake VPN prompts to unexpected wireless debugging toggles. Most of ToxicPanda 2.0’s tricks still rely on a victim granting permissions it should never get, so staying skeptical of unexpected pop-ups remains the simplest defense. For more on how major tech players are navigating today’s security and geopolitical pressures, see our coverage of Microsoft’s retreat in China.

Frequently Asked Questions