A banking trojan aimed at Android phones has returned with a much sharper set of tools. The ToxicPanda Android malware now asks victims to approve a VPN connection, then uses that access to cut the phone off from Google Play. Once that link goes dark, the device loses the checks that would normally catch a threat like this. Security scans, app verification, and remote removals all depend on that connection. So the attackers get a quiet window to work in.
The new version, tracked as ToxicPanda 2.0, targets 349 apps and accepts 167 remote commands. Both numbers are far higher than the previous build. But the permission trick is what makes this campaign worth paying attention to.
How the malware silences Google Play
Android lets any app request VPN service permission. That permission creates a local network interface on the phone, and every packet the device sends or receives passes through it. Privacy apps use this to encrypt traffic. Here, the same mechanism decides what traffic gets through and what does not.
Google is the first thing to go. After the user taps approve, the malware blocks communication with Google Play and Google Play Services. Those components handle app verification, Play Protect scanning, security updates, and Google’s ability to pull a harmful app off a device remotely. Block them, and most of Android’s built-in defence stops functioning.
Only then does the payload get extracted and installed. The malware then asks for Accessibility Service permission, which gives it near total control over the interface. Play Protect cannot phone home, so nothing interrupts the sequence.
Why the prompt is so hard to judge
At the moment of approval, a genuine VPN app and this one look identical. Android shows the same warning either way, and it cannot tell the user what the app plans to do with that tunnel. The decision comes down to trust in the app itself. That is a hard call for anyone installing software from outside the Play Store.
A far wider target list
The overlay component now covers 349 banking, finance, cryptocurrency, and e-wallet apps across 16 countries. A separate module harvests PINs from 140 financial and crypto apps. That second list updates on the fly, so operators can add new targets without pushing a new build.
Overlays the victim never sees
The phishing overlays are invisible. They sit on top of a legitimate banking app and capture touch input while the real interface stays visible underneath. Nothing looks wrong, and the victim keeps typing.
Fake screens that buy time
The ToxicPanda Android malware also spoofs the Android lock screen to collect PINs, unlock patterns, and passwords. Some samples went further and displayed fake system update screens. Those screens cover the display while the malware works in the background, which makes a frozen or unresponsive phone look like a normal update.
Wireless debugging becomes an attack path
The second standout feature involves the Android Debug Bridge. ADB is a command-line tool for running shell commands on a device, and Android 11 added a wireless version that works over Wi-Fi without a cable. Developers rely on it. Attackers have now started to as well.
Using Accessibility permissions, the malware enables Developer Options, switches on Wireless Debugging, reads the six-digit pairing code and port, and connects to the phone’s own ADB service. Shell access follows. From there it grants itself broad permissions without triggering the usual consent prompts, disables background restrictions, and switches on components silently.
Researchers at Zimperium, who documented the campaign, note that this technique is spreading. The RedHook trojan added a similar mechanism recently. So expect more Android families to pick it up.
Staying alive on the device
Persistence gets its own dedicated command. One instruction, called autoBoot, detects the handset manufacturer and opens the matching auto-start or power management settings page. Xiaomi, OPPO, Vivo, Samsung, and Huawei devices all run aggressive battery managers that kill background processes. This command steers the user into whitelisting the malware instead.
How infections start
Distribution runs through Amazon AWS storage buckets, not the Play Store. That means sideloading is the entry point in every case. Someone taps a link, downloads an APK, and approves the installation manually.
The route matters because it narrows the risk considerably. Most people never install apps this way. The victims are the ones following a link from a message, an ad, or a site pushing a supposedly better version of an app they already use.
What VPN users should take from this
The abuse of VPN permission here says nothing about VPN services themselves. A reputable provider does not block Google Play or hide overlays on your banking app. The issue is that Android grants the same powerful network permission to any app that asks, including malicious ones.
A few habits close the gap. Install VPN apps from Google Play or directly from the provider’s own site, and check which company actually publishes the app. Review your active VPN configurations in Android settings, since only one can run at a time and an unfamiliar entry is a warning sign. Also treat any app requesting both VPN and Accessibility access with real suspicion, because that combination gives away far more than most tools need.
Final Thoughts
The ToxicPanda Android malware works by turning a protective feature into a blindfold. Nothing about the technique is exotic, and that is what makes it effective. It uses permissions Android hands out by design, then quietly removes the safety net that would flag the problem.
For most people, the defence stays simple. Stick to official app sources, read permission prompts before approving them, and keep Play Protect running. A phone that suddenly loses contact with Google Play is telling you something worth investigating.
