A new variant of the prolific Android banking Trojan, ToxicPanda 2.0, has been discovered by security researchers, substantially expanding its potential victim count. The malware now targets 140 banking and cryptocurrency applications with a PIN-theft mechanism and 349 financial institutions with an overlay-based credential theft mechanism, a significant increase from its previous iteration, as reported by Infosecurity Magazine.Discovered by Zimperium's zLabs team, ToxicPanda 2.0 leverages the Android Accessibility Service to enable wireless debugging, effectively gaining shell access and bypassing standard runtime consent prompts. This allows it to execute high-privilege commands, neutralize background restrictions, and enforce persistence. A new feature also enables the theft of device lock credentials via screen overlay attacks, granting attackers persistent access. The majority of targeted financial institutions are located in Pakistan, South Africa, Mexico, Nigeria, and India.Experts recommend mitigating this threat by blocking sideloading on corporate devices, treating accessibility service grants as privileged access events, and alerting on the activation of developer options or wireless debugging via mobile device management. The trend highlights the abuse of legitimate platform features rather than exploitation of vulnerabilities.Source: Infosecurity Magazine
