ToxicPanda Android malware uses VPN permissions to block Google Play

Summary

The ToxicPanda Android malware has been updated with new capabilities, including the ability to block Google Play communications by abusing VPN permissions. This allows it to interfere with security checks and updates before installing its payload. The malware also employs phishing overlays, spoofs the lock screen to steal PINs and passwords, and uses Wireless ADB to gain shell access and bypass standard Android security prompts.

Full text

ToxicPanda Android malware uses VPN permissions to block Google Play By Bill Toulas August 23, 2026 10:23 AM 0 The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. The feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services. Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, Play Protect communication, or legitimate disruptions designed to protect users. After obtaining VPN service permissions, ToxicPanda 2.0 blocks communications to Google Play before extracting and installing its payload, then requests Accessibility Service permissions. Source: Zimperium Mobile security company Zimperium says that ToxicPanda 2.0 is being distributed through Amazon AWS-hosted buckets. Analysis of the malware revealed that it now includes functions to automate the Android Wireless Debugging Bridge (ADB), enabling shell-level access to infected devices. The latest version of the malware supports 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications targeting 16 countries. It also includes a separate PIN-harvesting module that targets 140 financial and cryptocurrency apps and can dynamically update the target list. According to the researchers, the app overlays are invisible to the victim, allowing the malware to capture touch inputs on targeted apps. ToxicPanda also spoofs the Android lock screen to capture device PINs, unlocking patterns, and passwords. Some analyzed malware samples also used fake system update screens to hide ongoing malicious activity. Fake update overlays used by ToxicPandaSource: Zimperium One command, ‘autoBoot,’ identifies the host device manufacturer and launches the corresponding OEM-specific auto-start or power management settings to maintain persistence. Zimperium reports that this bypasses battery consumption protections that kill background processes on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices. Abusing ADB One feature that stands out in the analyzed recent Toxic Panda version is its automatic abuse of the Android Debug Bridge (ADB) to gain shell access. ADB is the command-line tool for executing shell commands on Android devices. Wireless ADB, introduced in Android 11, provides this access over Wi-Fi without a USB connection. Using the Accessibility Services permission, the malware enables Developer Options, activates Wireless Debugging, extracts the six-digit ADB pairing code and port, and connects with the device’s local ADB service. Source: Zimperium “Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB daemon, the malware bypasses standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence,” Zimperium explains. Wireless ADB abuse is a growing trend among Android malware, as other Android malware authors have implemented it in their malicious tools. Recently, Group-IB reported a similar mechanism implemented in the latest version of the RedHook malware. Zimperium has published a list of indicators of compromise (IoCs) associated with the latest ToxicPanda version in this GitHub repository. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: New Manic Android malware can exfiltrate data through nearby devicesRedHook Android malware now uses Wireless ADB for shell accessHackers infect Android car head units with proxy botnet malwareAndroid malware combo takes out loans and relays victims' credit cardsGoogle says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse

Indicators of Compromise

• url — https://github.com/Zimperium/toxicpanda/blob/main/README.md

Entities