Android trojan 'ToxicPanda' can drain bank account

Multiple Android devices have been infected by a new trojan dubbed “ToxicPanda”. It primarily targets bank accounts but spoofs common apps to infect devices.

Android trojan ‘ToxicPanda’ threatens banking with advanced attack strategy

Smartphones are now one of the most widely used devices to perform banking functions. Mobile banking apps offer a secure and quick pathway for on-the-go banking. However, this presents an enticing opportunity for hackers and malware creators.

Back in 2023, Trend Micro, a popular antivirus platform, detected TgToxic, a powerful Android malware. TgToxic could steal credentials and funds from crypto wallets.

It appears another hacker or a group has borrowed TgToxic’s tech, and further weaponized the malware. Attackers are still targeting Android devices, but this time, the malware is going after banking apps using a clever technique.

The Cleafy’s Threat Intelligence team first discovered ToxicPanda. Believed to have originated in China, ToxicPanda has reportedly infected over 1500 Android devices around the world. The trojan seems to be preferring Android devices in Europe and Latin America.

How does ToxicPanda infect and spread on Android devices?

ToxicPanda is primarily a banking malware. However, it acts like a trojan. Moreover, it masquerades as several popular non-banking apps. When users download and side-load infected apps on their Android devices, ToxicPanda uses sophisticated methods to evade detection. It then monitors banking activities. Gradually, it initiates money transfers from compromised devices via Account Takeover (ATO), mentioned Cleafy researchers Michele Roviello, Alessandro Strino, and Federico Valentini.

ToxicPanda isn’t spreading via the Google Play Store or other popular Android app stores. Instead, it relies on unsuspecting victims’ habit of side-loading apps on their devices.

Simply put, Android device users must exercise extreme caution while obtaining Android installer files from outside official app stores. Smartphone users must completely avoid the practice if their Android device has banking apps. Additionally, users must regularly update apps and the Android OS installed on their devices from official sources.

Several cybersecurity experts have also warned banks and financial institutions. Banking apps, as well as users, must opt for multi-factor authentication, passkeys, OTPs, and other methods to safeguard their accounts.