ToxicPanda

Key Takeaways

• Android banking Trojan: ToxicPanda is designed to compromise Android devices, gain extensive control, and facilitate unauthorized financial activity.
• Staged infection: The malware can use multiple components, separating the initial delivery and installation stages from the payload responsible for malicious activity.
• Social engineering: Fake update screens and deceptive application prompts can convince victims to install malicious software or grant sensitive permissions.
• Accessibility abuse: ToxicPanda abuses Android Accessibility Services to automate interactions, manipulate system dialogs, and extend control over the compromised device.
• Network monitoring: The malware can use VPN functionality to monitor network traffic and support its broader surveillance capabilities.
• Persistence and concealment: ToxicPanda employs mechanisms designed to remain active, interfere with removal, and conceal malicious activity from the victim.
• Modular functionality: Additional components can be downloaded after the initial compromise, allowing the malware to extend or modify its capabilities during an infection.
• Command-and-control communication: Compromised devices communicate with remote infrastructure to register the device, receive instructions, and support further malicious operations.
• Multiple detection opportunities: Suspicious APK installations, Accessibility requests, VPN configuration, unexpected system overlays, persistence behavior, and network connections can provide useful detection signals for defenders.
• ANY.RUN’s Interactive Sandbox analysis helps investigate ToxicPanda’s behavior, including staged APK delivery, Accessibility abuse, VPN-based network monitoring, persistence, deceptive system overlays, and command-and-control communication.

What is ToxicPanda?

ToxicPanda is a banking Trojan designed for Android devices. Its primary purpose is to compromise mobile devices and give attackers the capabilities needed to access financial information and carry out fraudulent activity on behalf of victims.

Once established on a device, ToxicPanda can abuse legitimate Android functionality to gain a high degree of control over the user interface. In particular, its use of Accessibility Services can allow the malware to interact with applications, manipulate screens, approve prompts, and interfere with security settings.

The malware is also capable of intercepting authentication information, including two-factor authentication codes delivered through SMS. Combined with access to banking applications and other sensitive information, this capability can help attackers overcome additional authentication barriers and perform unwanted transactions.

ToxicPanda has expanded beyond its initial Southeast Asian targeting, with significant activity later observed across Europe, particularly in Italy, Portugal, and Spain.

This geographic expansion demonstrates why ToxicPanda is relevant not only as a mobile malware family but also as a threat to European banking customers and financial institutions.

Why ToxicPanda Presents a Serious Risk to Organizations

ToxicPanda is dangerous because it combines several capabilities that, individually, would already present a significant security concern.

Financial Theft

The central objective of a banking Trojan is financial fraud. By compromising a device used for banking, attackers can attempt to obtain credentials and authentication information and manipulate transactions directly from the victim's device.

ToxicPanda can use overlays and interface manipulation to imitate legitimate banking screens and capture information entered by the victim. The malware can deploy customized phishing overlays for specific banking applications, allowing attackers to tailor the malware to individual targets.

Accessibility Abuse

Accessibility Services are legitimate Android features intended to assist users with disabilities. ToxicPanda abuses this functionality to obtain extensive control over the device.

Once Accessibility access is granted, malware can potentially interact with buttons, dialogs, applications, and system settings without requiring the victim to manually approve every action.

Persistence and Concealment

ToxicPanda attempts to remain active and hide its activity from the victim. Persistence mechanisms can allow the malware to restart or maintain functionality after certain system events, while interface manipulation can prevent victims from reaching settings needed to remove it.

The sample analyzed by ANY.RUN for this article takes this further by presenting a convincing fake system-update screen, concealing malicious activity behind what appears to be a routine Android update.

Authentication Interception

The ability to obtain authentication information makes mobile banking malware particularly dangerous. Even when a financial service uses 2FA, an infected smartphone may allow the attacker to intercept or manipulate the authentication process.

ToxicPanda's capabilities therefore extend beyond simple credential theft: the compromised device itself can become an instrument for completing fraudulent activity.

Victimology: Who Could Be Exposed?

ToxicPanda primarily threatens Android users who use their smartphones for banking, digital wallets, payments, and other financial services.

The malware has expanded from Southeast Asia into Europe, with significant activity observed in Italy, Portugal, and Spain. It has also affected a range of Android devices, including Samsung, Xiaomi, and Oppo models.

From a victim's perspective, the most important risk factor is therefore not simply the phone model. It is whether the device is exposed to a malicious application and whether the user grants that application powerful permissions such as Accessibility access.

How Does ToxicPanda Operate?

Observing a ToxicPanda sample inside ANY.RUN’s Interactive Sandbox reveals a multi-stage infection chain involving deceptive APK delivery, Accessibility abuse, VPN-based network monitoring, persistence, hidden system overlays, and command-and-control communication.

Stage 1: Phishing Page Delivers the Initial Application

The activity begins with Chrome running on Android 14. The browser reaches a phishing page hosted through an AWS Lambda URL.

Instead of delivering legitimate content, the page initiates the installation of an Android dropper named ”Landed”.

The dropper uses the package name: com.nytx.fyijyki.ymkksb

Stage 2: “Landed” Impersonates a Legitimate Update

After installation, “Landed” presents a fake Google Play update screen.

The deceptive interface is intended to make the malicious installation appear legitimate and encourage the user to continue through the setup process.

This social-engineering stage is important because ToxicPanda relies heavily on convincing the victim to grant permissions that Android normally protects.

Stage 3: “Landed” Establishes VPN Functionality

“Landed” asks the user to configure a VPN through its PpVpn service.

This provides the malware with the ability to monitor network traffic generated by the device. At the same time, “Landed” reports installation stages to: api.globalgamingplatform.com

The server is used for tracking the progress of the installation rather than serving as the primary C2 identified later in the analysis.

Stage 4: The Dropper Installs the Payload

While the fake update interface is displayed, “Landed” installs a second APK through Android's PackageInstaller.

The payload uses the package name: com.daily.readermemo

This creates a staged infection process in which the initial application acts as a delivery mechanism for the more capable malicious payload.

Stage 5: The Payload Decrypts Its Code in Memory

The payload contains AES-encrypted code that is unpacked in memory.

Keeping significant functionality encrypted until runtime can make static inspection more difficult and helps conceal malicious logic from straightforward APK analysis.

Stage 6: ToxicPanda Requests Accessibility Access

The payload then prompts the victim to enable Accessibility for “Landed”.

The service presents itself as a screen-reader-type function, attempting to make the request appear consistent with legitimate Android accessibility functionality.

Once Accessibility access has been granted, the malware gains significantly greater control over the device interface.

Stage 7: Accessibility Is Used to Automate System Interaction

After Accessibility is enabled, the malware can interact with Android dialogs and settings automatically.

In the analyzed execution, this capability was used to:

• Click through system dialogs.
• Assist with malicious configuration.
• Prevent the malware from being easily uninstalled.
• Start malicious services.
• Manipulate the device interface.

This turns Accessibility from a user-assistance feature into a mechanism for automated device control.

Stage 8: The Malware Establishes Persistence

The malicious components start a foreground service and acquire WakeLocks.

These mechanisms help keep the malware active and prevent the device from entering states that could interrupt its operation.

The payload also attempts to interfere with its own removal, making ordinary uninstallation more difficult.

Stage 9: A Fake System Hides the Activity

One of the most deceptive behaviors observed in the ANY.RUN analysis is the presentation of a full-screen “Installing system update” overlay.

The screen resembles an ASUS system update process.

While the victim sees what appears to be a legitimate system operation, malicious activity continues underneath the overlay. This provides the attacker with an effective visual concealment mechanism and reduces the likelihood that the victim will recognize the ongoing compromise.

The malicious payload process, identified as PID 4608 during the analysis, was assessed as highly malicious by the sandbox.

Stage 10: The Infected Device Contacts C2

After establishing itself, the payload registers the device with a command-and-control server at: www[.]cctvv4[.]com

The initial communication uses: POST /api/device_log

The malware then establishes a WebSocket channel, allowing the compromised device to maintain communication with its operator.

Stage 11: Additional Modules Are Downloaded

The malware communicates with www[.]whh6666[.]com to retrieve dynamic modules.

This modular approach allows functionality to be delivered or updated after the initial infection rather than requiring every capability to be embedded directly in the first APK.

Stage 12: Telegram Communication Is Attempted

The analyzed sample also attempts to send a message through a Telegram bot.

The attempt was unsuccessful in the observed execution because the server returned: HTTP 403

Although the observed request was rejected, the behavior demonstrates that the malware can interact with external messaging infrastructure in addition to its primary C2 communications.

What Makes ToxicPanda Different from Conventional Ransomware?

ToxicPanda stands out because it does not depend on a single technique to compromise a victim. Instead, it combines social engineering, staged installation, accessibility abuse, credential interception, persistence, concealment, and remote communication.

The malware also demonstrates an ability to adapt its behavior to different targets. Research into ToxicPanda has documented customized phishing overlays for banking applications, while newer samples incorporate anti-analysis mechanisms and changing C2 infrastructure.

This flexibility is particularly important for banking malware. A threat actor does not necessarily need to compromise thousands or millions of devices to generate significant financial impact. A smaller number of successfully compromised banking customers can be sufficient to produce substantial losses.

Observable Signs of a ToxicPanda Infection

ToxicPanda infections may not always be immediately obvious. However, several behaviors can indicate compromise:

• An unexpected request to enable Accessibility Services for an unfamiliar application.
• A fake Google Play, Chrome, or system-update screen appearing outside normal update procedures.
• Applications attempting to prevent access to Android settings.
• Unexpected VPN configuration requests.
• Unknown applications appearing after visiting a suspicious website.
• Banking applications behaving unusually or displaying unexpected login screens.
• Unexpected SMS activity or missing authentication messages.
• Unexplained banking transactions.
• Increased network activity from an unfamiliar application.
• Unknown foreground services remaining active.
• Device behavior suggesting that applications or settings are being controlled automatically.

Any single symptom may have a legitimate explanation. Multiple indicators appearing together should be treated as a potential compromise.

ToxicPanda Detection Strategies

Monitor Accessibility Permissions

Accessibility access should receive particular attention in mobile security monitoring.

Organizations should identify applications that request Accessibility access without a clear business or accessibility purpose. Users should also periodically review which applications have this permission.

Monitor Unexpected VPN Configurations

An unfamiliar application requesting VPN functionality is another important warning sign.

Security teams should investigate unexpected VPN profiles or VPN services installed shortly before suspicious banking activity.

Monitor Application Installation Chains

A browser initiating the installation of an unfamiliar APK, followed by that application installing another APK, can indicate a staged mobile infection.

The ANY.RUN sample demonstrates how ToxicPanda can use a dropper to separate the initial delivery stage from the main payload.

Monitor Suspicious Network Communication

Network telemetry can help identify communications with known or suspicious infrastructure.

For the analyzed sample, notable destinations include:

• api[.]globalgamingplatform[.]com — installation-stage reporting.
• www[.]cctvv4[.]com — device registration and C2 communication.
• www[.]whh6666[.]com — dynamic module retrieval.

These indicators should be treated as sample-specific IOCs rather than universal ToxicPanda infrastructure.

Detect Deceptive Overlays

Mobile security controls should look for applications that use overlays to imitate banking or system interfaces.

ToxicPanda research has shown that customized overlays can be tailored to individual banking applications, allowing attackers to capture credentials while making the fraudulent interface appear legitimate.

Using Threat Intelligence to Investigate ToxicPanda

ANY.RUN Threat Intelligence can help SOC and MSSP teams move beyond a single infected device and investigate whether related ToxicPanda activity affects other systems.

Threat Intelligence Lookup can help security teams investigate ToxicPanda by correlating behavioral and infrastructure indicators, including:

• APK package names and file hashes
• Domains and IP addresses
• Network requests
• Command-and-control endpoints
• Payload delivery infrastructure
• Process and application behavior

threatName:"toxicpanda"

ANY.RUN’s Interactive Sandbox analysis can help reveal ToxicPanda’s staged APK installation, Accessibility abuse, VPN-based network monitoring, persistence mechanisms, deceptive system overlays, and command-and-control communication in an isolated environment. Threat intelligence can then help analysts correlate observed domains, network indicators, package names, and other artifacts to support broader investigations and identify potentially related activity.

Responding to a Suspected ToxicPanda Incident

If ToxicPanda is suspected on an Android device, the priority should be to contain the device and protect financial accounts.

• Stop using the compromised device for banking.
• Disconnect it from unnecessary network access where practical.
• Do not enter additional banking credentials or authentication codes on the suspected device.
• From a known-clean device, contact the relevant bank or financial provider and report suspicious activity.
• Review recent transactions and immediately report unauthorized payments.
• Change important credentials from a clean device.
• Review and revoke suspicious Accessibility, VPN, and application permissions.
• Remove unfamiliar applications where possible.
• If the device cannot be reliably cleaned, consider a factory reset and restore only trusted applications and data.
• Preserve relevant evidence, including suspicious APK names, domains, screenshots, and transaction records, if the incident needs to be investigated.

Because ToxicPanda can interfere with normal uninstallation and system interaction, simply deleting a suspicious application may not be sufficient to establish that the device is clean.

Reducing the Risk of ToxicPanda Attacks

Users can significantly reduce exposure to Android banking Trojans by following several basic practices:

Install Applications from Trusted Sources

Avoid installing APK files delivered through unsolicited websites, messages, advertisements, or fake update pages.

A legitimate Android update should not require downloading an unrelated APK from a suspicious domain.

Treat Accessibility Requests with Caution

Do not grant Accessibility access to applications that do not clearly need it.

This is especially important when the request comes immediately after installing an application from a website or when the application claims that Accessibility is required to complete an update.

Keep Android and Applications Updated

Security updates can address vulnerabilities and improve platform protections against malicious applications.

Review Financial Activity Regularly

Early detection can limit financial damage. Users should monitor bank accounts, payment applications, and digital wallets for transactions they do not recognize.

Use Banking Alerts

Transaction notifications can provide an early warning that an attacker is attempting to use compromised financial accounts.

Avoid Suspicious Update Prompts

Fake browser and system-update screens are a recurring social-engineering technique associated with mobile malware campaigns. Bitsight has documented fake Google Chrome update pages among the delivery techniques associated with ToxicPanda infrastructure.

Conclusion

ToxicPanda is a serious Android banking threat that combines device control, authentication interception, and financial fraud. Its abuse of Accessibility Services enables automated interactions and can help attackers carry out unauthorized transactions.

The malware has expanded into Europe, with significant activity reported in Italy, Portugal, and Spain. The ANY.RUN analysis demonstrates its multi-stage infection chain, from phishing and staged APK installation to persistence, fake system-update overlays, and C2 communication.

By combining social engineering, Accessibility abuse, concealment, and modular payloads, ToxicPanda poses a significant risk to Android users and highlights the importance of scrutinizing unfamiliar applications and permission requests.

Frequently Asked Questions: ToxicPanda

1. What is ToxicPanda?

ToxicPanda is an Android banking Trojan designed to compromise mobile devices, obtain sensitive financial information, and facilitate unauthorized transactions.

2. Can ToxicPanda intercept 2FA codes?

Yes. ToxicPanda is capable of intercepting authentication information, including 2FA codes delivered through SMS, which can help attackers bypass additional authentication protections.

3. How does ToxicPanda control an Android device?

A major component of its control strategy is the abuse of Android Accessibility Services. Once granted access, the malware can interact with applications, dialogs, and system settings.

4. Can ToxicPanda steal banking credentials?

Yes. ToxicPanda can use deceptive overlays and interface manipulation to capture credentials associated with banking and financial applications. Research has documented customized overlays targeting individual banking applications.

5. Does ToxicPanda target Europe?

Yes. ToxicPanda expanded beyond Southeast Asia into Europe, with significant activity documented in Italy during 2024 and Portugal and Spain becoming major targets in 2025.

6. How is ToxicPanda delivered?

Delivery can vary between campaigns. Documented techniques include malicious websites, fake update pages, and staged APK installation. In the ANY.RUN analysis covered here, a phishing page delivered the Landed dropper, which subsequently installed the malicious payload.

7. Can ToxicPanda prevent itself from being uninstalled?

The malware can use Accessibility capabilities to interfere with attempts to reach or manipulate Android settings and can employ persistence mechanisms to remain active.

8. What should be done if a phone is suspected to be infected with ToxicPanda?

Stop using the device for banking, contact financial institutions from a clean device, review and report unauthorized transactions, and investigate or reset the compromised Android device before returning it to normal financial use.

9. How can interactive sandboxing and threat intelligence help investigate ToxicPanda?

Interactive sandboxing allows SOCs and MSSPs to investigate ToxicPanda’s infection chain, including staged APK delivery, Accessibility abuse, VPN-based network monitoring, persistence mechanisms, fake system-update overlays, and command-and-control communication. Threat intelligence helps analysts investigate related activity by correlating indicators such as malicious APK package names, domains, network requests, and C2 infrastructure. Combining sandbox analysis with threat intelligence provides deeper context for identifying related indicators and supporting broader investigations.