ToxicPanda Android Malware Uses VPN Permissions to Block Google Play
ToxicPanda Android Malware Overview 🚨
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. This feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services.
How It Works 🔍
Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, and Play Protect communication, which are designed to protect users. After obtaining VPN service permissions, ToxicPanda 2.0 blocks communications to Google Play before extracting and installing its payload, then requests Accessibility Service permissions.
Advanced Capabilities 💻
Mobile security company Zimperium reports that ToxicPanda 2.0 is being distributed through Amazon AWS-hosted buckets. Analysis of the malware revealed that it now includes functions to automate the Android Wireless Debugging Bridge (ADB), enabling shell-level access to infected devices. Using the Accessibility Services permission, the malware enables Developer Options, activates Wireless Debugging, extracts the six-digit ADB pairing code and port, and connects with the device’s local ADB service.
Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB daemon. This allows the malware to bypass standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence.
Targeting Financial Apps 💰
The latest version of the malware supports 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications targeting 16 countries. It also includes a separate PIN-harvesting module that targets 140 financial and cryptocurrency apps and can dynamically update the target list. According to the researchers, the app overlays are invisible to the victim, allowing the malware to capture touch inputs on targeted apps. ToxicPanda also spoofs the Android lock screen to capture device PINs, unlocking patterns, and passwords.
Conclusion 🛡️
Zimperium has published a list of indicators of compromise (IoCs) associated with the latest ToxicPanda version in this GitHub repository.
For more details, read the full article.