Reported by 2 outlets
ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from cyberpress.org
ToxicPanda 2.0 Targets 349 Financial Apps and Abuses Android ADB for Shell-Level Access
cyberpress.org · 54d ago · August 20th, 2026
The malware now targets 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, compared with only 16 banking apps in the previously documented version. ToxicPanda first emerged as an Android banking threat targeting Europe and Latin America. Earlier research found that several remote commands were unfinished, but the newer version reportedly implements many of these functions and expands the malware’s command set to 167 commands. Previous analysis also linked ToxicPanda to on-device fraud operations, where attackers remotely operate a victim’s legitimate banking session. ToxicPanda 2.0 Abuses Android ADB The updated malware abuses Android Accessibility Services to automate user-interface actions, read screen elements, capture touch input, and deploy phishing overlays. It reportedly requests VPN privileges through a fake installation screen, blocks Google Play and Google Play Services network communications, then decrypts and installs its concealed payload. Its most concerning capability is the automated abuse of Android’s Wireless Debugging feature. ToxicPanda 2.0 checks whether Developer Options are enabled and, if necessary, simulates taps on the Build Number field to activate them. It then opens Developer Options, turns on Wireless Debugging, selects the pairing option, and extracts the six-digit pairing code and dynamic port from the screen. ToxicPanda 2.0 control panel (Source: zimperium) Using the captured details, the malware performs lo
-
update from gbhackers.com
ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays
gbhackers.com · 54d ago · August 20th, 2026
ToxicPanda 2.0, an evolved Android banking Trojan that significantly expands its fraud, device control, and credential theft capabilities. The updated malware uses invisible overlays to capture PIN input from more than 140 banking and cryptocurrency applications, while its broader phishing framework targets 349 banking, financial, e-wallet, and crypto applications across 16 countries. ToxicPanda was previously […] The post ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .