Security researchers have uncovered a significantly upgraded version of the ToxicPanda Android banking trojan, showing how mobile malware is evolving from simple credential theft into full device takeover and on-device fraud.
The new variant, tracked as ToxicPanda 2.0, was detailed by Zimperium zLabs. According to the research announcement, the malware now includes 167 remote commands, expands credential-theft targeting to 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, and adds new features designed to maintain long-term control over infected Android devices.
What Happened
ToxicPanda is not a completely new malware family. It was previously documented as an Android banking trojan linked to the broader TgToxic lineage, with earlier campaigns targeting banking users in Europe and Latin America. Cleafy’s earlier research found that ToxicPanda was used for account takeover and on-device fraud, allowing attackers to operate directly from an infected phone rather than only stealing login credentials.
The updated ToxicPanda 2.0 variant represents a major expansion in both scale and capability. Zimperium says the malware now targets hundreds of financial apps, including banks, e-wallets, and cryptocurrency platforms, while also introducing more advanced automation and control functions.
One of the most important new capabilities is a PIN-theft workflow designed to target more than 140 banking and cryptocurrency applications. This means the malware is not only interested in usernames and passwords, but also in the app-level authentication codes users rely on to approve access or transactions.
Why ToxicPanda 2.0 Is Dangerous
The danger of ToxicPanda 2.0 is that it targets the trusted device itself.
Many banks and crypto platforms rely on the user’s phone as a trusted security factor. If the transaction appears to come from the same device, same app, same session, and same user interaction flow, it can be harder for fraud systems to detect.
That is the core idea behind on-device fraud.
Instead of stealing credentials and logging in from a suspicious external device, attackers try to operate from the victim’s already-authenticated phone. Cleafy previously described ToxicPanda as part of a modern generation of mobile malware with remote access capabilities that allow attackers to perform account takeover directly from the compromised device.
Key Capabilities
ToxicPanda 2.0 includes several capabilities that make it more dangerous than earlier variants.
The malware can support remote commands, abuse Android functionality, steal credentials, and maintain persistence. Zimperium highlighted new features including automated ADB abuse, lock screen credential theft, and the expanded command set of 167 remote commands.
Earlier ToxicPanda research also documented abuse of Android Accessibility Services, remote control functionality, OTP interception, and obfuscation techniques. These capabilities allow the malware to manipulate the device, observe user actions, capture sensitive data, and help attackers complete fraudulent transactions.
In practical terms, a compromised Android device may give attackers access to:
- banking app credentials
- crypto wallet app credentials
- app PINs
- one-time passwords
- authentication prompts
- screen content
- remote-control capability
- device-level persistence
- transaction approval flows
This turns the phone into both the target and the attack platform.
Why PIN Theft Matters
PIN theft is especially important because many mobile banking and crypto apps use short app-level PINs as a second layer of protection.
Users may assume that even if their password is stolen, the attacker still needs the phone PIN, app PIN, or biometric approval. ToxicPanda 2.0 challenges that assumption by targeting the device where those approvals happen.
If malware can observe or capture the PIN workflow, the attacker may be able to bypass protections that were designed to stop remote fraud.
That does not mean every infected user will immediately lose funds, but it significantly increases the risk of unauthorized access, fraudulent transfers, and crypto theft.
Overlay Attacks and Credential Theft
Like many Android banking trojans, ToxicPanda can use overlay attacks.
In an overlay attack, the malware displays a fake login screen on top of a legitimate banking or crypto app. The user believes they are entering credentials into the real app, but the information is captured by the malware.
Zimperium says ToxicPanda 2.0 expanded credential theft from a smaller set of targets to 349 banking, financial, e-wallet, and cryptocurrency applications.
This makes the malware more scalable. Instead of focusing on a handful of banks, the operators can target users across many regions and financial platforms.
How It Spreads
Public reporting on ToxicPanda and related TgToxic activity has repeatedly pointed to distribution outside official app stores, often through social engineering, phishing pages, fake apps, or sideloaded APK files.
Earlier Cleafy research listed ToxicPanda’s infection chain as sideloading via social engineering.
TgToxic payloads have been distributed through dropper APK files, likely via SMS messages or phishing websites, although the exact delivery mechanism was not fully confirmed.
This is why Android users should be cautious with apps installed from links, messaging platforms, fake update pages, unofficial app stores, or files sent through SMS and chat apps.
Link to TgToxic Evolution
ToxicPanda appears connected to the wider TgToxic ecosystem.
TgToxic was first documented as a banking trojan capable of stealing credentials and funds from crypto wallets and financial apps. Later variants added more advanced anti-analysis capabilities and more resilient command-and-control techniques.
TgToxic operators continued changing the malware after public reporting, including improved emulator detection and updated command-and-control methods designed to make analysis and disruption harder.
ToxicPanda 2.0 fits that pattern: the malware is evolving quickly, expanding targets, adding commands, and improving its ability to compromise devices.
Why Mobile Banking Malware Is Getting Worse
The rise of malware like ToxicPanda 2.0 reflects a broader shift in cybercrime.
Banking moved to mobile. Crypto wallets moved to mobile. Digital identity moved to mobile. MFA prompts moved to mobile. Corporate access and password managers are often used on mobile devices too.
Attackers are following that trust.
A compromised phone can be more valuable than a compromised laptop because it may hold:
- banking apps
- crypto wallets
- authenticator apps
- SMS messages
- email accounts
- password manager sessions
- identity documents
- messaging apps
- corporate access tools
That makes mobile malware a direct threat to both consumers and enterprises.
What Users Should Do
Android users should take the risk seriously, especially if they use mobile banking or cryptocurrency apps.
Recommended steps:
- Install apps only from official stores.
Avoid APK files from links, Telegram groups, SMS messages, fake update pages, and unofficial app stores. - Be suspicious of apps requesting Accessibility permissions.
Banking trojans often abuse Accessibility Services to control the device and capture data. - Do not ignore Play Protect warnings.
Google has previously stated that Android users are protected against known versions of related malware by Google Play Protect, which can warn or block malicious apps even when they come from outside Google Play. - Remove unknown apps immediately.
If an app icon disappears, behaves oddly, asks for excessive permissions, or claims to be a security update, treat it as suspicious. - Use strong app-level security.
Enable biometric login where available, but remember that device malware may still target the approval flow. - Monitor bank and crypto accounts closely.
Look for unusual logins, new payees, withdrawals, transfers, or device registrations. - If compromise is suspected, use a clean device.
Do not reset passwords or move funds from the infected phone. Use another trusted device and contact the bank or wallet provider.
What Financial Institutions Should Do
Banks, fintechs, and crypto platforms should assume that some users’ devices may be compromised.
Recommended controls include:
- mobile threat detection inside banking apps
- detection of overlay and Accessibility abuse
- device integrity checks
- behavioral analytics for on-device fraud
- transaction risk scoring
- anomaly detection for unusual navigation and transfer behavior
- step-up verification for risky transfers
- detection of remote-control activity
- controls against automated interaction patterns
- user warnings when dangerous permissions are detected
The key is to stop trusting the device blindly.
If the phone itself is under attacker control, normal login and MFA signals may not be enough.
Final Thoughts
ToxicPanda 2.0 shows how quickly Android banking malware is evolving.
The malware is no longer focused only on stealing passwords. It is expanding across hundreds of banking, e-wallet, and cryptocurrency applications, adding remote-control capabilities, stealing app PINs, and helping attackers conduct fraud directly from the victim’s own device.
The user may still see the real banking app.
The login may still happen on the real phone.
The transaction may still appear to come from a trusted device.
But the attacker may be controlling the process behind the scenes.
Mobile devices are now part of the financial security perimeter. Users, banks, crypto platforms, and enterprises must treat Android malware as a direct threat to identity, payments, and digital assets.
