Overview
- Zimperium zLabs published a detailed technical analysis and indicators of compromise, disclosing ToxicPanda 2.0 on Wednesday and sharing IOCs to help defenders detect infections.
- The new variant expands targeting from a few banks to 349 banking, e‑wallet and cryptocurrency applications across 16 countries, with many targets in Pakistan, South Africa, Mexico, Nigeria and India.
- ToxicPanda 2.0 adds 167 remote commands and a PIN‑theft workflow that specifically targets about 140 banking and crypto apps, plus an overlay method that can capture lock‑screen credentials.
- The malware abuses Android Accessibility and developer/debugging features to enable wireless ADB, gain shell privileges, grant persistent permissions and install backdoors without exploiting vulnerabilities.
- Security teams are urged to apply Zimperium's IOCs, block sideloading on managed devices, treat Accessibility grants as privileged events, alert on enabled developer options or wireless debugging, and deploy on‑device mobile threat protection.