ToxicPanda 2.0 Chains VPN, Accessibility, and ADB

1. Basic Information Article Title : The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile Publisher : Zimperium zLabs Publication Date : 2026-08-19 Update Date : None Severity : high Original Source : Zimperium zLabs Related Sources : Zimperium IOC repository , ToxicPanda Android malware uses VPN permissions to block Google Play , Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight Related Entities : malware: ToxicPanda 2.0 groups: Not specified in public reports cves: None products: Android 11 and later, Android Accessibility Service, Wireless Debugging, Android Debug Bridge (ADB), Google Play, Google Play Services, Amazon Web Services (AWS-hosted buckets) 2. Executive Summary ToxicPanda 2.0 is an Android banking malware. It uses fake installation screens to gain VPN and Accessibility permissions. Then, it automatically operates Android settings to connect to the local ADB daemon. Without rooting the device, it uses shell privileges to change settings and add persistence. Finally, it steals financial information using Accessibility and fake screens or overlays. 3. Attack Flow 1. Distribution and Initial Setup The attacker uses Amazon Web Services storage to distribute ToxicPanda 2.0 samples. The specific method to trick users into downloading the file is not public. The dropper shows a fake installation screen and asks the user to allow an Android VPN connection. After permission is granted, the local VPN blocks network traffic to Google Play and Google Play Services. The dropper decrypts and installs an encrypted payload from its assets, then asks the user to enable the Accessibility Service. 2. Exploiting Wireless Debugging and ADB The Accessibility Service reads the Android settings screen. If Developer Options are disabled, it automatically taps "Build number" seven times to enable them. It goes to the Wireless Debugging screen, enables the feature, and opens "Pair device with pairing code." It uses Accessibility to rea