- ToxicPanda 2.0 now supports 167 remote commands and targets over 140 banking and cryptocurrency apps across 16 countries.
- The malware abuses Android accessibility services to steal credentials, harvest PIN codes, and enable wireless debugging for privilege escalation.
- GoldDigger malware is using a sophisticated packer called dpt-shell to obfuscate code, with a new campaign heavily infecting South Africa and the U.K.
- Both malware families establish WebSocket connections to command-and-control servers for real-time data exfiltration and fraudulent transactions.
Cybersecurity researchers have uncovered an upgraded version of the ToxicPanda Android malware, now targeting over 140 banking and cryptocurrency applications globally. According to a Zimperium report, the malware has expanded from 16 banking apps to 349 financial institutions across 16 countries.
ToxicPanda 2.0 abuses Android accessibility services to steal every UI element on screen and deploy overlay-based credential theft. It also siphons lock screen PINs using a fake overlay and automatically enables Android Wireless Debugging via ADB for privilege escalation.
The malware connects to its command-and-control server via a bidirectional WebSocket channel, receiving 167 remote commands. It can display full-screen “system update” overlays to conceal background actions and even overwrite the device’s local lock screen PIN with an attacker-defined value.
Meanwhile, the GoldDigger banking trojan has been linked to massive infections in South Africa and the U.K. It was first documented by Group-IB in October 2023 and attributed to the Chinese-speaking threat actor GoldFactory.
GoldDigger uses a sophisticated packer called dpt-shell to obfuscate its code and evade analysis. It can inject input into banking apps to mimic user interactions, initiating fraudulent transactions from the victim’s account.
The malware also gives operators real-time screen access, captures credentials via fake overlays, and runs targeted apps within a virtual environment. To stay safe, users should review installed apps, audit permissions, and enable two-factor authentication on all accounts.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Solana surges 12% to $86 as crypto market eyes $100 milestone
- Flock Safety AI Tool Lets Police Track Drivers by Movement Alone
- HYPE Token Nears Record High, Outperforms Bitcoin on Trump News
- Bitcoin Surges Above $69K on Treasury’s Doubled Buyback Plan
- GnosisDAO OKs Gnosis Chain shift to ZK Ethereum rollup
