ToxicPanda 2.0 malware: New tactics blocking Google Play and abusing wireless ADB on Android
- Thảo Nguyên
- 1 hour ago
- 2 min read
ToxicPanda malware on Android OS has upgraded to a new version featuring network traffic control and automated deep device takeover capabilities. By abusing built-in system features, this malware strain silently bypasses security layers and directly tampers with numerous financial applications.
Blocking Google Play connections via VPN service permissions
In version 2.0, ToxicPanda prompts users to grant VPN (Virtual Private Network) service permissions to establish a local network interface on the device. Through this interface, the malware can inspect and block data traffic passing between the phone, Google Play, and Google Play Services.
Tampering with network traffic allows ToxicPanda to disable system safety check mechanisms, including Google Play Protect safeguards, app verification processes, and security updates.
The malware operates through the following steps:
Requesting VPN service permissions.
Blocking outbound connections to Google Play.
Extracting and installing malicious payload files.
Prompting users to grant additional Accessibility Service permissions.
According to cybersecurity firm Zimperium, this new version is currently being distributed via Amazon AWS hosting infrastructure.
Targeting financial apps and harvesting user information
ToxicPanda 2.0 supports 167 remote commands and can generate fake overlay screens for 349 apps spanning banking, finance, e-wallets, and cryptocurrency across 16 countries.
These overlays are completely invisible to users, enabling the malware to record all screen taps. Additionally, it features a dedicated module for harvesting PIN codes across 140 financial applications, using a dynamically updateable target list.
The malware also spoofs the Android lock screen to steal device passwords, PINs, or unlock patterns, while displaying fake system update screens to obscure background malicious activity.
Bypassing battery saver mechanisms for persistence
The malware incorporates a command named 'autoBoot' to automatically identify the manufacturer of the infected device. Once identified, it triggers device-specific auto-start or power management settings based on the OEM.
This trick allows ToxicPanda to bypass standard battery optimization features meant to kill background apps, maintaining long-term persistence on devices from Xiaomi, OPPO, Vivo, Samsung, and Huawei.
Abusing wireless ADB debugging
A notable feature of ToxicPanda 2.0 is its ability to automatically abuse wireless ADB (Android Debug Bridge) - developer tool introduced in Android 11 to transmit commands over Wi-Fi without cables.
The malware executes the ADB attack through the following steps:
Utilizing Accessibility Service permissions to access Developer Options.
Enabling Wireless Debugging.
Extracting the 6-digit pairing code along with the connection port.
Connecting directly to the local ADB service on the device.
Once elevated permissions are granted via the ADB process, the malware can self-grant extensive privileges, disable background execution limits, and silently activate critical components without requiring on-screen user confirmation.
According to Zimperium's assessment, abusing wireless ADB is becoming a growing trend among Android malware, similar to the RedHook malware strain recently documented by Group-IB. Indicators of Compromise (IoCs) related to ToxicPanda 2.0 have been publicly released by Zimperium on GitHub.
The evolution of ToxicPanda 2.0 highlights how threat actors are increasingly sophisticated in leveraging built-in Android system tools to manipulate devices. Understanding the operational mechanics of new malware strains enables users to heighten vigilance and proactively safeguard personal data.
Reference: SecurityWeek
Comments