ToxicPanda Android malware expands to 349 apps, 167 commands

AI digestMimile.ai EditorialAugust 23, 2026 at 07:23 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

ToxicPanda Android malware expands to 349 apps, 167 commands

ToxicPanda Android malware has evolved to target 349 applications and support 167 remote commands, according to mobile security firm Zimperium. The malware now requests VPN permissions to block Google Play communications before installing its payload. It also automates Android Debug Bridge abuse to gain shell access on infected devices.

Key Facts

ToxicPanda 2.0 targets 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries.
The malware supports 167 remote commands and includes a PIN-harvesting module for 140 financial and cryptocurrency apps.
ToxicPanda 2.0 is distributed through Amazon AWS-hosted buckets, according to Zimperium.
The malware requests VPN service permissions to block communications from Google Play and Google Play Services.
ToxicPanda automates Android Wireless Debugging Bridge (ADB) abuse to gain shell-level access on infected devices.

VPN Permission Abuse

ToxicPanda 2.0 requests VPN service permissions to create a local interface that controls network traffic. This enables the malware to block communication from Google Play and Google Play Services. Network-level control allows interference with app verifications, updates, and Play Protect communication. After obtaining VPN permissions, ToxicPanda blocks Google Play communications before extracting and installing its payload. The malware then requests Accessibility Service permissions to continue its attack chain.

ADB Automation

ToxicPanda 2.0 includes functions to automate the Android Wireless Debugging Bridge (ADB), enabling shell-level access. Using Accessibility Services, the malware enables Developer Options and activates Wireless Debugging. It extracts the six-digit ADB pairing code and port, then connects with the device's local ADB service. The 'autoBoot' command identifies the device manufacturer and launches OEM-specific auto-start settings to maintain persistence. This bypasses battery consumption protections on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices.

Phishing and PIN Harvesting

ToxicPanda 2.0 uses phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications. The overlays are invisible to victims, allowing the malware to capture touch inputs on targeted apps. A separate PIN-harvesting module targets 140 financial and cryptocurrency apps and can dynamically update the target list. ToxicPanda spoofs the Android lock screen to capture device PINs, unlocking patterns, and passwords. Some analyzed samples used fake system update screens to hide ongoing malicious activity.

2 sources

ToxicPanda Android malware expands to 349 apps, 167 commands

bleepingcomputer.com

BleepingComputer

darkreading.com

Dark Reading

Technology

Positive Technologies detects DragonDoll spyware hitting Android users in 26 countries

Positive Technologies detects a new spyware program, DragonDoll, hitting Android users in more than 26 countries, including Russia. The malware first appeared this spring during analysis of an attack on users in Saudi Arabia, and specialists have collected about 150 samples over two months. Victims lured by a fake Google Chrome update risk losing passwords, PIN codes, and data from Telegram and WhatsApp.

Technology

ChainDrop supply-chain attack infects over 1,300 npm packages with 2 billion monthly downloads

A self-propagating supply-chain worm dubbed ChainDrop has infected more than 1,300 npm packages with over 2 billion monthly downloads, security researchers reported on August 4. The malware automatically executes upon installation, stealing developer credentials and cloud tokens from compromised systems. It spread through the npm registry by hijacking a popular maintainer’s GitHub account and using legitimate CI/CD workflows to publish poisoned releases.

Technology

StopAndProtect Campaign Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Check Point researchers identify a global cybercrime operation dubbed StopAndProtect that uses nearly 2,000 hacked WordPress sites to distribute malware and steal victim data. The campaign, discovered in mid-May 2026, deploys a toolkit of ransomware, credential stealers, and a lock-screen component while its operators exfiltrate files, screenshots, and activity logs.

Technology

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Security researchers at Abnormal discovered iAuthFlow v2, a malware toolkit sold on Russian forums for over $10,000 that lets attackers regain access to compromised email accounts even after password resets. The tool phishes credentials from Google, Microsoft, iCloud, or LinkedIn, then silently creates an attacker-controlled passkey. Abnormal advises users to audit passkeys, OAuth tokens, mail rules, and remove rogue authentication methods.

ToxicPanda Android malware expands to 349 apps, 167 commands

Key Facts

VPN Permission Abuse

ADB Automation

Phishing and PIN Harvesting

Read more

Read more