Dangerous Android banking malware looks to trick victims with fake money transfers

• ToxicPanda can initiate money transfers and even grab MFA codes
• The banking trojan is targeting consumers in Europe and Latin America
• More than 1,500 devices already compromised

A Chinese hacker is targeting Android devices in Europe and Latin America with a banking trojan able to steal money from victim’s accounts.

A new report from cybersecurity researchers Cleafy says the trojan, ToxicPanda, is quite similar to a piece of older, known malware called TgToxic, which was first spotted in 2023. The two have some similarities, although ToxicPanda can be described as a “lite” version, since many features seem to be stripped down, and some were left as simple placeholders.

Despite being lighter, ToxicPanda is still a capable piece of malware. It can initiate money transfer, intercept one-time passwords (OTPs) generated both through SMS or authenticator apps, and manipulate user inputs. It can also steal sensitive information from the compromised device, and capture data from other apps. However, to do all that, the app needs to be given permission to access Android’s accessibility services, which is a usual red flag for Android-borne malware.

Years-long campaign

In any case, the malware is usually hidden in fake Chrome, Visa, or 99 Speedmart apps, most likely distributed through third-party websites, social media channels, and possibly phishing. The malicious apps cannot be found on official app repositories (Google Play Store, Samsung’s app store, or similar), and the researchers still speculate on how the apps are being advertised across the web.

So far, the threat actor seems to have infected more than 1,500 Android devices. The majority is located in Italy…