ToxicPanda Banking Trojan Infects Over 1,500 Android Smartphones, Targets 16 Banks: Report

ToxicPanda — a banking trojan that’s believed to be in an early stage of improvement — has been detected by safety researchers in Europe and Latin America. It is believed to be derived from one other banking trojan detected in 2023, and is used to remotely take over accounts on compromised telephones, permitting attackers to switch funds whereas bypassing safety measures aimed toward stopping suspicious transactions. ToxicPanda was reportedly discovered on over 1,500 units, whereas concentrating on customers of 16 banking establishments.

Researchers at Cleafy’s Threat Intelligence detected a brand new Android malware in October that they beforehand detected as TgToxic, one other banking trojan that was actively utilized in Southeast Asia and was recognized by the group final 12 months. The researchers discovered that the brand new pattern didn’t comprise capabilities from TgToxic, and that the code was not just like the unique trojan.

The ToxicPanda trojan is disguised as well-liked functions
Photo Credit: Cleafy

As a outcome, the researchers began to trace the newly detected distant entry trojan (RAT) as ToxicPanda and warns that the malware can result in account takeover (ATO) after a sufferer’s gadget is contaminated. Cleafy’s Threat Intelligence group additionally says that by choosing handbook distribution (sideloading, utilizing social engineering), menace actors (TA) can circumvent a financial institution’s safety measures which are used to maintain customers protected.

In order to entry virtually all data on a person’s gadget, the malware exploits the accessibility service on Android, permitting it to seize knowledge from all apps. It can be able to sidestepping two-factor authentication (similar to OTPs) by capturing the contents of the display. 

The creators of the ToxicPanda malware are Chinese audio system, in response to the researchers. Over 1,500 units have been contaminated with the ToxicPanda trojan and customers from Italy have been essentially the most impacted — greater than 50 p.c of all contaminated units. Other impacted areas embrace Portugal, Spain, France, and Peru. Customers of 16 banks have been reportedly focused by the TAs utilizing the ToxicPanda trojan.

The researchers additionally level out that present antivirus options have didn’t detect these threats, which suggests the necessity for a “proactive, real-time detection system”. A botnet of contaminated units was additionally noticed in use in Europe and Latin American nations, which means that the Chinese-based TAs are actually turning their consideration to different markets.