ToxicPanda 2.0 Hijacks VPN Permissions to Blind Google Play Protections
The ToxicPanda Android malware has evolved into version 2.0, expanding its reach to 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries while supporting 167 remote commands. The malware requests VPN service permissions to create a local network interface, which allows it to control and block traffic from Google Play and Google Play Services. This network-level control lets it interfere with app verifications, updates, and Play Protect security checks before extracting and installing its payload.
According to researchers at Zimperium, ToxicPanda 2.0 is distributed through Amazon AWS-hosted buckets and includes a function that automates the Android Debug Bridge (ADB), giving attackers shell-level access to infected devices. The malware deploys invisible phishing overlays that capture touch inputs on targeted apps, and it spoofs the Android lock screen to steal device PINs, unlocking patterns, and passwords. A separate PIN-harvesting module targets 140 financial and cryptocurrency apps and can dynamically update its target list, while some samples use fake system update screens to hide malicious activity.
The malware also maintains persistence through an autoBoot command that identifies the device manufacturer and opens OEM-specific auto-start or power management settings, bypassing battery optimization protections on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices. Zimperium notes that ToxicPanda 2.0 first blocks Google Play communications, then requests Accessibility Service permissions to deepen its control. Users are advised to avoid sideloading apps from untrusted sources and to review any app that requests VPN or accessibility permissions unexpectedly.