ToxicPanda Banking Trojan Infects Over 1,500 Android Smartphones, Targets 16 Banks: Report

ToxicPanda — a banking trojan that’s believed to be in an early stage of growth — has been detected by safety researchers in Europe and Latin America. It’s believed to be derived from one other banking trojan detected in 2023, and is used to remotely take over accounts on compromised telephones, permitting attackers to switch funds whereas bypassing safety measures geared toward stopping suspicious transactions. ToxicPanda was reportedly discovered on over 1,500 gadgets, whereas concentrating on customers of 16 banking establishments.

Researchers at Cleafy’s Risk Intelligence detected a brand new Android malware in October that they beforehand detected as TgToxic, one other banking trojan that was actively utilized in Southeast Asia and was recognized by the group final 12 months. The researchers discovered that the brand new pattern didn’t include capabilities from TgToxic, and that the code was not much like the unique trojan.

The ToxicPanda trojan is disguised as common purposes
Picture Credit score: Cleafy

In consequence, the researchers began to trace the newly detected distant entry trojan (RAT) as ToxicPanda and warns that the malware can result in account takeover (ATO) after a sufferer’s machine is contaminated. Cleafy’s Risk Intelligence staff additionally says that by choosing handbook distribution (sideloading, utilizing social engineering), risk actors (TA) can circumvent a financial institution’s safety measures which are used to maintain customers protected.

With the intention to entry virtually all info on a person’s machine, the malware exploits the accessibility service on Android, permitting it to seize information from all apps. It’s also able to sidestepping two-factor authentication (corresponding to OTPs) by capturing the contents of the display screen. 

The creators of the ToxicPanda malware are Chinese language audio system, based on the researchers. Over 1,500 gadgets had been contaminated with the ToxicPanda trojan and customers from Italy had been essentially the most impacted — greater than 50 p.c of all contaminated gadgets. Different impacted places embrace Portugal, Spain, France, and Peru. Prospects of 16 banks had been reportedly focused by the TAs utilizing the ToxicPanda trojan.

The researchers additionally level out that present antivirus options have did not detect these threats, which suggests the necessity for a “proactive, real-time detection system”. A botnet of contaminated gadgets was additionally noticed in use in Europe and Latin American nations, which means that the Chinese language-based TAs at the moment are turning their consideration to different markets.