ToxicPanda 2.0 Turns Android Accessibility into a 349-Bank Credential Pipeline
Zimperium's zLabs flags a straight-line escalation in Android banking malware: ToxicPanda 2.0 grew its fake-login overlays from 16 banking apps to 349 financial institutions across 16 countries, and added PIN theft across 140+ banking and crypto apps. The kicker is access, not just volume. By abusing the Android Accessibility Service, the trojan grants itself shell-level control, silently enables Wireless Debugging via ADB, and rewrites the victim's lock-screen PIN. Distribution has shifted to AWS-hosted buckets.