ToxicPanda 2.0 Android Trojan Steals Banking Data via Fake Updates

THE ToxicPanda 2.0 banking Trojan is a malicious malware targeting Android users across 349 financial applications in 16 countries. It uses deceptive overlays to steal login credentials, employing techniques like Accessibility Service abuse to gain permissions silently. Distributed via AWS-hosted buckets as fake system updates, it can execute 167 remote commands, including changing device passwords and exfiltrating sensitive data. Defense against this threat involves monitoring application permissions and deploying advanced mobile threat detection solutions.