ToxicPanda 2.0 Enhances Android Banking Malware with PIN Harvesting

On Wednesday Zimperium zLabs reported a new variant of the Android malware known as ToxicPanda (aka TgToxic) that brings significant enhancements, including a set of 167 remote commands and an expanded global targeting footprint. The update also introduces GoldDigger to broaden its reach into additional financial applications. Details were disclosed in a report published by The Hacker News.¹

The latest release features a PIN‑harvesting workflow that targets more than 140 banking and cryptocurrency applications on Android devices. By hooking runtime application behavior in memory, the trojans can intercept sensitive data before encryption occurs—an approach that does not require root privileges or traditional methods, making detection harder than static analysis alone would suggest. This technique mirrors vectors used against mobile banking customers through Cerberus Trojan since 2016, which stole SMS messages containing OTPs from primarily European financial institutions and has now spread globally due to app store distribution networks lacking robust review processes.¹

For users, any Android device with banking or crypto apps could be vulnerable if it installs unknown third‑party apps or extensions. Because the malware can harvest PINs without rooting, ordinary security measures may not suffice. Users should verify app permissions, avoid suspicious downloads, keep their OS updated, and use multi‑factor authentication whenever possible. Vendors are urged to harden app sandboxing and implement stricter permission checks to mitigate future attacks.

With the rise of sophisticated banking trojans such as ToxicPanda 2.0, vigilance is essential because attackers evolve techniques toward AI-driven phishing that mimics legitimate apps more convincingly. Monitoring and quick patching will help defend against these new threats.