The ToxicPanda Android malware has been updated with a capability to request VPN service permissions, allowing it to intercept and block network traffic from Google Play and Google Play Services before installing its payload. The upgrade is part of a broader expansion that brings the malware’s target list to 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries, and its command set to 167 remote instructions.
The VPN permission request is not cosmetic. Once granted, ToxicPanda 2.0 creates a local network interface through which it controls traffic passing in and out of the device. By cutting off communication with Google Play before the payload is extracted and installed, the malware can sidestep app verification checks, Play Protect scans, and other integrity mechanisms that might otherwise flag or interrupt the infection. Only after that blockade is in place does ToxicPanda 2.0 request Accessibility Service permissions, the second major permission the malware depends on.
ToxicPanda Android Malware VPN and ADB: A Two-Stage Takeover
The Accessibility Services permission does considerably more than grant visual access to the screen. ToxicPanda 2.0 uses it to enable Developer Options on the infected device, activate Wireless Debugging (a feature introduced in Android 11 that provides Android Debug Bridge access over Wi-Fi without a USB cable), extract the six-digit ADB pairing code and port, and connect to the device’s local ADB service.
According to Zimperium, once the malware gains shell user permissions through this route, it executes high-privilege commands directly through the ADB daemon, bypassing Android’s standard runtime consent prompts. The malware can then grant itself broad permissions, neutralise background process restrictions, silently enable critical components, and enforce its own persistence, all without the user being prompted to approve anything.
PC Risk notes that the shell-level access obtained this way carries UID 2000 privileges, which go well beyond what a standard Android application can normally reach, though they fall short of full root access. That distinction matters: the malware operates in a highly elevated state without triggering the detection mechanisms that full root exploitation would typically set off.
One command in particular, labelled ‘autoBoot’, illustrates how carefully the malware has been engineered for longevity. It identifies the host device’s manufacturer and opens the corresponding OEM-specific power management or auto-start settings, ensuring ToxicPanda survives the battery-saving background-process kills that Xiaomi, OPPO, Vivo, Samsung, and Huawei devices apply by default. Zimperium distributes the malware via Amazon AWS-hosted buckets, and has published indicators of compromise in a public GitHub repository.
Phishing Overlays, PIN Harvesting, and a Widening Target List
The operational toolkit extends beyond network manipulation and shell access. The malware’s phishing overlays are invisible to the victim, silently capturing touch inputs on targeted applications. A separate PIN-harvesting module targets 140 financial and cryptocurrency apps and can update its own target list dynamically. ToxicPanda also spoofs the Android lock screen to capture device PINs, unlock patterns, and passwords, while some samples use fake system update screens to mask ongoing activity.
The geographic picture has shifted alongside the technical upgrades. According to Bitsight, ToxicPanda campaigns initially concentrated on Italy in 2024 before pivoting toward Portugal and Spain in 2025. That shift coincides with a broader surge in mobile banking threats: Bitsight reports a 196% increase in Trojan banker attacks on smartphones in 2024 compared to the previous year, resulting in more than 1.24 million attacks on Android devices.
Wireless ADB abuse is not unique to ToxicPanda. Zimperium notes it is a growing trend in Android malware more broadly, and Group-IB recently reported a similar mechanism in the latest version of the RedHook malware. What sets ToxicPanda 2.0 apart is the combination: VPN-layer blocking to neutralise Play Protect, ADB automation for shell-level persistence, invisible overlays, and a dynamically updated target list, all operating in a privilege tier that standard app-based detection is not designed to catch. Zimperium’s published IoC list is the immediate starting point for defenders looking to identify infections in their environments.
