Toxic Panda 2.0 and Gold Digger Expand Android Banking Attacks with On-Device Fraud
Summary: Zimperium zLabs reported that ToxicPanda 2.0, an Android banking trojan active since at least July 2022, now carries 167 remote commands, a PIN harvesting workflow aimed at more than 140 banking and cryptocurrency apps, and overlay credential theft targeting 349 financial institutions across 16 countries, up from 16 banking apps in the prior version. The update adds a fake lock-screen overlay to siphon credentials, abuses Android accessibility services to enable Developer Options and Wireless Debugging via ADB for privilege escalation, and is distributed through Amazon AWS-hosted buckets, while a separate GoldDigger campaign attributed to the Chinese-speaking GoldFactory group impersonates airlines and retailers and has driven what IBM Trusteer described as a massive infection in South Africa and the U.K.
Bottom line: ToxicPanda 2.0's targeting list grew from 16 banking apps to 349 financial institutions in 16 countries, and GoldDigger can inject taps and keystrokes into a banking app to initiate transactions from the victim's own device - fraud that originates on the handset, not from a stolen password.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026