TOXICPANDA 2.0, evolving from its previous iteration, targets 349 financial apps across 16 countries, vastly expanding from just 16 apps previously. The malware starts as a dropper, disguising itself to gain VPN permissions, thereby blocking Google Play Protect and installing its payload. It exploits Android's Accessibility Service to monitor victims' screens and capture data. A new privilege escalation method utilizes Android's Wireless Debugging, allowing deep access to devices.
ToxicPanda can steal banking credentials via overlays on banking apps and even lock screens, highlighting its sophisticated mechanisms, including commandeering cloud infrastructure for distribution. Ongoing threats necessitate new security measures that move beyond traditional protective layers.