ToxicPanda 2.0 turns Android banking malware into an enterprise threat

ToxicPanda, an Android banking Trojan first observed in November 2024, has returned in a version that is less a specialized banking tool than a general-purpose foothold on the device. ToxicPanda 2.0 adds 167 remote commands and expands the malware’s target list from 16 financial institutions to 349 banking, e-wallet and cryptocurrency applications, according to research from Zimperium’s zLabs team.

The compromised phone may also be the employee’s authentication device, passkey store and entry point to corporate services. A Trojan that remains active on the underlying Android system can do more than intercept a transaction inside one banking app.

From banking fraud to device control

The new variant uses Android features intended for administration and development to move toward shell-level control. It abuses Accessibility Services to enable Developer Options, activate Wireless Debugging, extract the temporary Android Debug Bridge (ADB) pairing code and complete pairing with the device’s ADB service, Zimperium said.

Recommended reading

Claude agents turned a coding test into a turf war

Sophia Reynolds • Aug 23, 2026 • 6 min read

Wireless Debugging was introduced in Android 11 to let developers connect to a device through ADB without a physical USB connection. ToxicPanda automates the normally visible setup process, turning a legitimate maintenance pathway into a privilege-escalation mechanism.

Once paired, the malware can execute commands directly through a device shell. That access can allow attackers to grant themselves additional permissions, weaken operating-system restrictions, enable components and establish persistence. Application-level abuse can target a banking session, while shell access gives the operator a route to alter the device’s security posture and maintain control after the initial fraud attempt.

ToxicPanda 2.0 also adds a lock-screen overlay intended to capture credentials entered by the victim. That can expose the device’s lock-screen PIN as well as credentials that protect other services. The malware’s distribution infrastructure has changed too: researchers observed samples delivered through buckets hosted on Amazon Web Services. The operators are using legitimate cloud infrastructure to distribute the Trojan.

“The device this Trojan takes over is the same device that approves push MFA prompts, holds passkeys, and runs the banking and wallet apps for the employee and the company both.”

Smith said that stealing the lock-screen PIN and resetting the device password through administrator privileges could give an attacker what he called the user’s “identity anchor,” along with the accounts behind it. The risk includes authentication interference, credential theft and manipulation of applications—not just unauthorized banking transactions.

Why managed phones are in scope

ToxicPanda’s initial activity involved taking over Android devices and facilitating fraudulent mobile banking transactions in Latin America, Italy, Portugal and Spain. Its later expansion to 16 countries and the jump to 349 targeted financial applications indicate a broader and more capable operation, although the supplied research does not establish how many devices have been infected or whether the campaign is active in the United States.

A managed phone can simultaneously approve push-based multifactor authentication, hold passkeys, access banking and wallet applications, and connect to corporate applications and services. Persistent malware control could turn one endpoint into a path toward several classes of account.

Zimperium researcher Vishnu Pratapagiri described the expansion this way:

“The updated version demonstrates a significant expansion in targeting scope and capabilities.”

A signature match against a known banking package isn’t enough when the attack chain also uses Accessibility Services, Developer Options, Wireless Debugging and ADB. Zimperium recommended multilayered protection that can disrupt the malware at multiple stages rather than relying solely on conventional signature-based detection.

Controls enterprises can apply now

BeyondTrust’s Smith recommends blocking sideloading on devices enrolled in corporate identity systems. That limits installation paths outside the organization’s managed application controls, though the source does not say that sideloading is the only distribution method used by this campaign.

He also recommends treating Accessibility Service grants as privileged-access events that are logged and reviewed. On managed devices, security teams should alert when users or applications enable Developer Options or Wireless Debugging. Those settings are observable through mobile-device management, Smith said, but organizations often aren’t monitoring them.

“That is a sign your mobile device management can already see, and few are watching for it.”

Detection after compromise remains an issue. ToxicPanda 2.0's use of normal Android administration and debugging functions can make the attack harder to distinguish from legitimate device support activity, while its persistence features give attackers time to exploit more than the financial apps named in the targeting list. The reporting provides no independent infection count, US campaign data or evidence that Google has changed Android’s Wireless Debugging behavior in response.