Researchers are issuing another warning about mobile banking malware. Two Android trojans, ToxicPanda 2.0 and GoldDigger, show how attackers are increasingly trying to gain smarter access to phones so they can steal payment and login credentials. Both families make strikingly heavy use of what Android offers through accessibility features, fake overlays, and control mechanisms related to device permissions.
In this article, we lay out the key features and translate them into concrete measures for users and organizations that manage mobile devices.
ToxicPanda 2.0: more commands and a wider reach
ToxicPanda (also known as TgToxic) has been spotted in the wild since 2022. In the latest version, ToxicPanda 2.0, researchers describe “significant enhancements”: the malware package now includes a set of 167 remote commands and targets a much broader range of victims. While the previous variant focused on a limited number of banking applications, coverage in this update is clearly expanded.
An important part is how the malware abuses the screen and user interaction. By using the Android accessibility service, the threat can, in principle, read all UI elements on the device. In addition, ToxicPanda combines a overlay-based mechanism to harvest login credentials or PIN-like inputs.
From lock screen to real transactions
According to the report, the PIN-harvesting process targets more than 140 banking and cryptocurrency apps. There is also evidence of redirecting credential data via a fake overlay that makes the user believe everything is running normally. Researchers also mention deceiving the user with full-screen “system update” overlays. That allows malicious actions to continue in the background without immediately raising suspicion.
Furthermore, it is noted that ToxicPanda previously had not (fully) implemented certain commands and is now filling in additional capabilities. This includes processing extra access and device control-related instructions.
ADB and Wireless Debugging: moving toward higher privileges
Another new element involves an automated clicking mechanism that lets attackers abuse Android Wireless Debugging through Android Debug Bridge (ADB). The idea is that the malware—using accessibility—activates Developer Options and turns on Wireless Debugging.
Once that setting is reached, the attacker can then potentially take more targeted steps toward privilege escalation and shell-level access on compromised devices. In other words, the attack is not only a “surveillance” risk—it can also lead to additional control over the system.
How ToxicPanda communicates with the attacker
ToxicPanda 2.0 contacts its command-and-control (C2). It begins with an initial HTTPS request to establish a bidirectional WebSocket connection. Through this channel, the malware receives commands and can exchange data.
It is also described that the threat performs profiling of the infected device. The malware can determine which OEM brand is active and then take steps to prevent battery optimization from hindering background execution. Accessibility features are used for this as well.
Bypassing device settings: Device Administrator and lock screen manipulation
In the latest campaign, the report also points to techniques that influence user permissions. For example, ToxicPanda includes a prompt intended to get the victim to allow the malware to obtain Device Administrator rights. It also mentions that the local lock screen PIN or password can be overwritten with a value set by the attacker.
That makes the threat extra difficult to remove—or can disrupt access to the device—exactly when the user has not yet figured out the real cause.
Distribution via the cloud: AWS-hosted buckets
Finally, researchers note a shift in distribution. ToxicPanda 2.0 samples appear to be delivered through Amazon AWS-hosted buckets. With this type of infrastructure, attackers can distribute malware at scale and make delivery more flexible, without everything depending on a single fixed server location.
GoldDigger: on-device fraud with overlays and real-time screen access
Alongside ToxicPanda, GoldDigger is at the center of the reports. This Android banking trojan was first documented in October 2023 and targets on-device fraud, meaning fraud carried out on the device itself once the app is installed on the phone.
According to researchers, GoldDigger is linked to a threat actor that is particularly active with malware families capable of affecting both Android and iOS. The current campaign highlights a focus on South Africa and the United Kingdom, with “massive infection” in which victims install apps pretending to be well-known brands.
Obfuscation and anti-analysis
According to the report, GoldDigger uses a packer called dpt-shell. This technique is meant to hide code and resources to make analysis harder. In addition, various evasion techniques are described, including checks for whether Frida is present—if it is, the malware may crash.
The description also says they prevent external debuggers from attaching by marking the process as being traced via the PTRACE system call.
Accessibility permissions as the engine for fraud
Victims who install the deceptive apps are then asked to grant accessibility services permissions. GoldDigger abuses those rights to orchestrate fraudulent actions within banking applications.
Concretely, the malware can inject input into a banking app to mimic interaction—entering text, pressing buttons, and performing gestures. The system can then initiate fraudulent transactions from within the banking app, without the victim necessarily seeing right away that the input did not truly come from them.
Fake overlays and real-time interception via C2
As with ToxicPanda, deceiving the user plays a central role. GoldDigger can show fake overlays to capture credentials while the victim is entering sensitive data. In addition, the attacker can obtain real-time access to the victim’s screen.
It is further described that GoldDigger can analyze runtime behavior and perform interception on multiple levels. For example, the malware can run a specific app inside a virtual environment. This gives the attacker better visibility into exactly what happens when the user uses the app.
Command-and-control in GoldDigger
GoldDigger also sets up a C2 mechanism via WebSocket. This is used to receive commands requesting privileges such as accessibility and location permissions. The malware can then read input from other apps via accessibility and collect data such as contacts and SMS messages.
Additionally, the threat can record audio and video and stream it via the RTMP protocol to the C2 server. It can also open specific URLs and launch apps, such as the Google Play Store and the settings menu.
What can you do now? Practical protection against mobile banking malware
Because both families show strong overlap in abusing permissions and overlay techniques, you can take measures that broadly help. Below are the main actions the report also recommends, translated into practical steps for everyday safety.
- Check your installed apps and remove anything you don’t recognize or find suspicious.
- Review app permissions carefully before granting accessibility rights or other sensitive permissions.
- Install apps only from trusted sources and from known developers.
- Keep your device up to date so vulnerabilities and security gaps have less chance to be exploited.
- Use 2FA for accounts you use online, including banking accounts.
- Monitor your bank accounts for unusual transactions or patterns.
For extra context on threats like these, it can be helpful to also look at incidents and measures related to “sandboxing” and isolation of AI and model components, because this shows how isolating code or processes can limit abuse. See, for example: AI model security with sandboxing.
Extra attention for organizations managing Android devices
If you manage Android devices within a company, it’s wise to look not only at app lists, but also at permission flows. Make sure devices are aware of which apps are granted access to accessibility, and educate users about the typical “motivation” behind such requests.
It also helps to rehearse the incident response process: what do you do if someone accidentally installs a suspicious app? Which accounts are checked first, and how quickly can you isolate the device? This helps prevent a malware family from gaining time to cause impact through overlays, PIN harvesting, or real-time interception.
Conclusion
Mobile banking malware continues to evolve quickly. ToxicPanda 2.0 expands its attack scope with many commands, PIN harvesting via accessibility, and deception via overlays, while it can also move toward Wireless Debugging via ADB for additional control. GoldDigger, in contrast, is driven by on-device fraud: deceptive apps request accessibility permissions, after which the malware can handle credentials and sensitive data through overlays, interaction injection, and real-time screen access.
By actively checking installed apps and permissions, applying updates, enabling 2FA, and monitoring banking transactions, you reduce the chance that threats like these affect your device or organization.
Source: https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html
