Full research report
ToxicPanda Android malware uses VPN permissions to block Google Play
Executive assessment
ToxicPanda 2.0 represents a meaningful capability leap for a banking trojan family under continuous development since at least 2022 and publicly tracked since Cleafy's October 2024 disclosure. The introduction of VPN permission abuse to neutralise Google Play Protect is a novel evasion technique that specifically disables Android's primary on-device integrity mechanism before payload installation, a step that earlier variants did not include. Combined with fully automated wireless ADB exploitation — which yields shell-level access without any user-visible consent after the initial Accessibility Service grant — the malware achieves device control comparable to device-owner provisioning. The expansion from 16 to 349 targeted financial applications, paired with a dynamically updatable target list, confirms a mature and operationally active campaign rather than a proof-of-concept sample. Actor attribution remains 'likely Chinese-speaking' across three independent research organisations based on code and infrastructure indicators, but no named group has been formally confirmed, and the campaign's relationship to the separately active GoldFactory cluster is unestablished.
What happened
On 22 August 2026, Zimperium's zLabs team disclosed ToxicPanda 2.0, a substantially evolved Android banking trojan first identified by Cleafy in October 2024. The updated variant introduces VPN permission abuse to suppress Google Play Protect communications during payload installation, a fully automated five-phase wireless ADB exploitation chain for shell-level device access, and phishing overlays now targeting 349 financial applications — a twenty-fold increase from the original version's 16. The campaign is currently distributed via Amazon AWS-hosted storage buckets.
Affected scope
Android devices globally; 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries. Documented infections in Italy, Portugal, Spain, France, and Peru; the 2025 campaign botnet reached approximately 4,500 devices before this variant's release. A separate PIN-harvesting module targets 140 financial and cryptocurrency applications with a dynamically updatable target list.
Technical assessment
The dropper presents a counterfeit installation interface requesting VPN service permission. Once granted, it creates a local network interface to intercept and drop traffic destined for Google Play and Google Play Services — neutralising app verification, Play Protect scans, and legitimate update prompts — before decrypting and sideloading the actual payload. The payload then requests Accessibility Service permission, which drives a five-phase automated sequence: enabling Developer Options via automated tap sequences, navigating to Wireless Debugging settings, extracting the six-digit SPAKE2 pairing code, completing cryptographic authenticated pairing, and issuing commands directly through the ADB daemon at shell privilege without further consent prompts. An 'autoBoot' command identifies device manufacturer and activates OEM-specific auto-start settings to maintain persistence despite battery management on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices.
Recommended defensive actions
- Disable installation from unknown sources on all managed Android devices via MDM policy to prevent sideloaded dropper execution
- Enforce Google Play Protect to remain active and configure MDM alerting on any attempt by an application to disable it
- Block or alert on VPN service permission requests from applications not distributed through a verified enterprise channel or the Play Store
- Audit Accessibility Service grants on all Android endpoints and revoke access for any unrecognised applications immediately
- Deploy mobile threat defence capable of detecting overlay attacks, unauthorised Wireless ADB sessions, and anomalous outbound WebSocket connections
- Subscribe to Zimperium's published ToxicPanda 2.0 IoC feed and integrate file hashes and C2 indicators into endpoint and network detection rules
Uncertainties and evidence gaps
- The specific list of 16 targeted countries in the 2.0 campaign has not been publicly enumerated by Zimperium
- No confirmed botnet size for the ToxicPanda 2.0 campaign has been disclosed; the 4,500-device figure predates this variant
- Threat actor identity is unconfirmed beyond circumstantial Chinese-language and infrastructure indicators; no named group has been formally attributed
- The relationship between ToxicPanda operators and the separately reported GoldFactory group (GoldDigger) has not been established
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
Actively deployed as a banking trojan across at least 16 countries via sideloaded dropper applications; no CVE association. Exploitation relies on user-granted VPN and Accessibility Service permissions rather than a software vulnerability, with confirmed on-device fraud activity.
The investigation opened with the BleepingComputer article's claim that Zimperium had disclosed a new ToxicPanda variant abusing VPN permissions to suppress Google Play Protect. Initial searches confirmed the Zimperium blog as the primary source and surfaced corroborating reports from SecurityAffairs, The Hacker News, and Bitsight. Fetching the Zimperium blog confirmed the five-phase ADB exploitation chain and VPN interception mechanism in technical detail. Historical context from Cleafy's October 2024 original discovery report and Bitsight's 2025 campaign study established the Chinese-speaking actor assessment and the botnet's European expansion trajectory, grounding the 2.0 disclosure in a well-documented threat lineage with high confidence.
- What has Zimperium disclosed about ToxicPanda 2.0, and when was it published?Searched for 'ToxicPanda 2.0 Android malware Zimperium 2026'
Zimperium published the ToxicPanda 2.0 disclosure on 22 August 2026, identifying 167 remote commands, 349 targeted applications, VPN and wireless ADB abuse, and AWS-hosted delivery infrastructure.
why Established the event date and primary source prior to fetching authoritative documents.
- What is the precise VPN and ADB abuse mechanism?Searched for 'ToxicPanda malware VPN permissions ADB Google Play block 2026'
Confirmed VPN permission is used to intercept and block Google Play traffic during payload installation; Accessibility Service drives a five-step ADB pairing sequence for unapproved shell access.
why Verified the headline technical claims before opening primary sources to avoid anchoring on secondary summaries.
- What does the primary Zimperium report confirm in detail?Fetched the Zimperium blog postzimperium.com ↗
Confirmed five-phase ADB workflow (Developer Options → Wireless Debugging → SPAKE2 pairing code extraction → authenticated pairing → shell command execution), AES-ECB C2 encryption over WebSocket HTTPS, and a published IoC repository on GitHub.
why Primary source confirms technical claims at sufficient depth to assess severity, detection opportunities, and defensive priority without inferring from secondary coverage.
- Does the BleepingComputer article accurately represent the Zimperium findings?Fetched the BleepingComputer articlebleepingcomputer.com ↗
Corroborated VPN abuse, ADB exploitation, and the 'autoBoot' OEM persistence command bypassing battery management on Xiaomi, OPPO, Vivo, Samsung, and Huawei; confirmed overlays are invisible to the victim.
why Validated the source article's accuracy and surfaced the OEM-specific persistence detail not prominently featured in the Zimperium blog summary.
- Who are the threat actors behind ToxicPanda and what is the campaign's origin?Searched for 'ToxicPanda banking trojan origin threat actor Chinese 2024 2025'
Cleafy first identified ToxicPanda in October 2024 and assessed likely Chinese-speaking operators based on hardcoded Chinese DNS, Mandarin code strings, and C2 panel language; the family is related to TgToxic.
why Established actor lineage and original campaign scope to contextualise the significance of the 2.0 evolution.
- What does the original Cleafy report confirm about actor attribution and initial campaign scope?Fetched the Cleafy ToxicPanda original disclosure reportcleafy.com ↗
Confirmed Chinese-speaking operators via Chinese DNS (114.114.114.114), Mandarin strings, and C2 panel evidence; initial botnet of over 1,500 devices across Italy (56.8%), Portugal, Hong Kong, Spain, and Peru in late 2024.
why Provides the strongest available attribution evidence, correctly qualifying actor assessment as 'likely' rather than confirmed, which sets the appropriate confidence level for downstream claims.
- Does The Hacker News independently corroborate the 2.0 technical claims?Fetched The Hacker News article on ToxicPanda 2.0thehackernews.com ↗
Independently corroborated ADB abuse mechanism, 349-app targeting scope, and AWS delivery; reported GoldDigger separately, confirming the two campaigns are not the same actor.
why Second independent domain confirming principal technical claims; separation of GoldDigger from ToxicPanda prevents conflation of distinct campaigns.
- What does Bitsight's 2025 study establish about the campaign's infrastructure and evolution?Fetched Bitsight TRACE 2025 ToxicPanda studybitsight.com ↗
Documents botnet growth to approximately 4,500 devices concentrated in Portugal and Spain; identifies TAG-124 traffic distribution infrastructure, a monthly domain generation algorithm, and Mandarin remnants in the 2025 codebase.
why Establishes the pre-2.0 campaign baseline, corroborates the actor assessment with an independent organisation, and provides infrastructure context confirming the campaign's operational maturity.
Research coverage
All 67 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok1 records | Primary evidence2 matched items | Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1674 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5332 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1011 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok7934 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1590 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Technical references2
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories2
Primary technical report from the discovering organisation; includes IoC repository reference, five-phase ADB chain detail, and full command inventory
Official Zimperium press release corroborating scope, 349-app targeting, and defensive guidance
Analysis & research5
Original October 2024 discovery report establishing Chinese-speaking actor assessment and initial campaign scope of 1,500 infected devices
Documents botnet growth to ~4,500 devices, TAG-124 delivery infrastructure, domain generation, and Mandarin codebase remnants corroborating actor lineage
Independent corroboration of ADB mechanism, 349-app scope, and AWS delivery from a second reporting domain
Corroborates device-administrator API abuse and remote lock-screen credential reset capability
Detailed narrative corroborating autoBoot OEM persistence bypass across Xiaomi, OPPO, Vivo, Samsung, and Huawei