Home / Technology / ToxicPanda Malware Hijacks VPNs for Android Takeover
ToxicPanda Malware Hijacks VPNs for Android Takeover
24 Aug
Summary
- Malware abuses VPN permissions to disable Google Play Protect.
- ToxicPanda 2.0 targets 349 banking and crypto apps across 16 countries.
- It can gain shell-level control and steal device PINs or passwords.
A sophisticated Android banking trojan, ToxicPanda 2.0, has been identified by security researchers. This malware exploits the legitimate VPN permission to disable crucial Google security features, including Google Play Protect, effectively blinding the device to malicious activity.
Once Google's protections are circumvented, ToxicPanda 2.0 proceeds to install hidden payloads. The malware's scope has significantly increased from its previous iteration, now targeting 349 banking, e-wallet, and cryptocurrency applications across 16 different countries.
Beyond its primary data-harvesting capabilities, which include overlaying fake login screens and capturing PINs, ToxicPanda 2.0 can also spoof the Android lock screen to steal credentials. Furthermore, it leverages Android's Wireless Debugging feature to achieve shell-level access, granting itself elevated permissions without user interaction.
