ToxicPanda 2.0 Blocks Google Play via VPN Permissions and Seizes Control of Android over ADB

Researchers at Zimperium report a substantially updated version of the Android malware ToxicPanda. The trojan's second generation has expanded its target list to 349 apps and learned to execute 167 remote commands — and, most importantly, has acquired several mechanisms for bypassing Android's built-in protections.

VPN Permissions vs. Google Play

The key new feature is a request for VPN permissions. By creating a local network interface, ToxicPanda 2.0 routes all of the device's traffic through itself and blocks requests to Google Play and Google Play Services. Control at the network level lets it suppress app checks, updates, and the operation of Play Protect. Before unpacking and installing its payload, the malware severs the connection to Google's store, after which it requests Accessibility Service permissions.

Automating Wireless ADB

What stands out in particular is the automated abuse of the Android Debug Bridge. Relying on Accessibility permissions, the malware enables developer mode, activates wireless debugging (introduced in Android 11), extracts the six-digit pairing code and port, and then connects to the local ADB service. Having obtained shell access, the trojan issues commands directly to the ADB daemon, bypassing the standard consent dialogs: it grants itself broad permissions, disables the OS's background restrictions, and entrenches itself in the system. According to Group-IB, the RedHook malware recently used a similar technique — a technique that is becoming a trend.

Data Theft and Disguise

ToxicPanda covers 349 banking, financial, cryptocurrency, and e-wallet apps in 16 countries with invisible phishing overlays, intercepting the victim's taps. A separate module hunts for PINs across 140 financial and crypto apps, with the target list updated dynamically. The trojan spoofs the lock screen to collect PINs, pattern keys, and passwords, while masking its activity behind fake system-update screens.

There is also a persistence mechanism: the autoBoot command identifies the device manufacturer and opens the corresponding OEM autostart and power-management settings. In this way the malware bypasses the battery-saving protections that kill background processes on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices.

According to Zimperium, ToxicPanda 2.0 is distributed through storage hosted on Amazon AWS. A list of indicators of compromise has been published in the company's GitHub repository.

Source: Bleeping Computer