Full Report
Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications.
Analysis Summary
# Tool/Technique: ToxicPanda (aka TgToxic) 2.0
## Overview
ToxicPanda is a sophisticated Android banking trojan designed to perform On-Device Fraud (ODF). Its primary purpose is to bypass multi-factor authentication and initiate unauthorized financial transactions directly from a victim's device by abusing accessibility services and remote command capabilities.
## Technical Details
- **Type:** Malware Family (Banking Trojan)
- **Platform:** Android
- **Capabilities:** Remote Access Trojan (RAT), Credential Theft, Overlay Attacks, ADB Manipulation, PIN Harvesting.
- **First Seen:** July 2022 (Original variant); August 2026 (Updated 2.0 version reported).
## MITRE ATT&CK Mapping
- **[TA0031 - Network Effects]**
- **[T1465 - Real-time Data Interception]**
- **[TA0006 - Credential Access]**
- **[T1411 - Input Capture]**
- **[T1512 - Screen Capture]**
- **[TA0004 - Privilege Escalation]**
- **[T1548.001 - Abuse Accessibility Features]**
- **[TA0011 - Command and Control]**
- **[T1071.001 - Web Protocols (HTTPS/WebSockets)]**
## Functionality
### Core Capabilities
- **Accessibility Service Abuse:** Steals UI elements from the screen and intercepts user interactions.
- **Overlay Attacks:** Deploys fake login screens over 349 financial and cryptocurrency applications to harvest credentials.
- **C2 Communication:** Utilizes bidirectional WebSocket channels over HTTPS for real-time command execution.
- **PIN Harvesting:** Employs an invisible transparent overlay to capture touch inputs and record device PINs.
### Advanced Features
- **Wireless Debugging Exploitation:** Automatically enables Android Developer Options and Wireless Debugging (ADB) to gain shell-level access and escalate privileges.
- **On-Device Fraud (ODF):** Executes 167 remote commands to perform transactions directly on the infected device, bypassing traditional fraud detection.
- **Persistence & Evasion:** Profiles OEM vendors to bypass battery optimization and requests Device Administrator privileges to prevent uninstallation.
- **Lock Screen Overwrite:** Can remotely change the device’s local lock screen PIN/password to an attacker-defined value.
## Indicators of Compromise
- **File Hashes:** [Specific hashes not provided in the text; research Zimperium zLabs reports for SHA256 lists]
- **File Names:** Often disguised as "System Update" or popular banking/utility apps.
- **Network Indicators:**
- `hxxps[://]amazon-aws-hosted-buckets[.]com` (Delivery infrastructure)
- WebSocket-based C2 channels (Defanged)
- **Behavioral Indicators:**
- Unexpected requests for Accessibility Services.
- Automatic toggling of "Developer Options" or "Wireless Debugging."
- Persistent "System Update" full-screen overlays.
## Associated Threat Actors
- Unknown (Current 2.0 campaign shows global expansion).
- **GoldFactory:** (A related Chinese-speaking actor mentioned in the same report, responsible for the GoldDigger family).
## Detection Methods
- **Signature-based detection:** Scanning for known ToxicPanda APK signatures and the "dpt-shell" packer.
- **Behavioral detection:** Monitoring for apps requesting both Accessibility Services and the ability to "Draw over other apps" simultaneously.
- **Anomaly Detection:** Identifying unauthorized ADB connections or unexpected WebSocket traffic from mobile devices.
## Mitigation Strategies
- **User Education:** Advise users never to enable "Accessibility Services" for apps from untrusted sources.
- **Hardening:** Disable "Developer Options" and "USB/Wireless Debugging" unless actively needed for development.
- **App Source Control:** Enforce policies to only install applications from the official Google Play Store and utilize Mobile Threat Defense (MTD) solutions.
- **Biometric Enforcement:** Use biometrics where possible, as these are harder to harvest via overlays than PINs.
## Related Tools/Techniques
- **GoldDigger / GoldPickaxe:** Similar Android malware using the "dpt-shell" packer for evasion.
- **Manic:** Another Android malware using "System Update" overlays for concealment.
- **ATS (Automated Transfer Systems):** The underlying technique used to automate fraudulent transactions.