ToxicPanda 2.0 and GoldDigger Android Banking Malware: Detection and Hardening Guide for On-Device Fraud

What defenders need to know

Zimperium zLabs reporting on ToxicPanda 2.0, also tracked as TgToxic, alongside GoldDigger, is a reminder that mobile banking malware has matured from credential theft into full on-device fraud. The reported ToxicPanda update is not a cosmetic variant. Researchers describe a broader global targeting footprint, a remote-command set of 167 commands, and a PIN harvesting workflow aimed at more than 140 banking and cryptocurrency applications. GoldDigger activity in the same ecosystem reinforces the operational trend: attackers are moving the fraud decision point onto the victim device, inside the legitimate banking session, where traditional server-side controls have less visibility.

No CVE identifier is provided in the reporting, and defenders should not wait for one. This is an active malware and fraud problem, not a patch-management problem. The exploitation status should be treated as in-the-wild criminal deployment unless your telemetry proves otherwise. There is no indication in the summary of CISA KEV inclusion, but that is irrelevant for mobile trojan campaigns distributed through smishing, malicious ads, counterfeit app pages, droppers, and sideloaded APKs.

The organizations most exposed are banks, credit unions, crypto exchanges, payment providers, fintech platforms, enterprises with bring-your-own-device fleets, and any SOC whose visibility stops at Windows endpoints while customers authenticate from Android phones.

Technical analysis

Affected platform: Android devices running consumer or enterprise builds where users can be induced to install an APK, grant Accessibility Services, allow display-over-other-apps, approve notification or SMS access, or accept device-admin-style control. The summary specifically calls out global targeting and more than 140 banking and cryptocurrency applications, so defenders should assume brand-agnostic phishing and regionally localized lures rather than a narrow single-bank campaign.

The defensive attack chain for this class of Android banking trojan is consistent with ToxicPanda, TgToxic, and GoldDigger reporting and should be modeled as follows:

Delivery: victim receives a smishing text, malicious ad, Telegram or WhatsApp message, spoofed bank alert, fake security update, or cloned app-store page pointing to an APK outside Google Play.
Install: user enables installation from unknown sources or a dropper abuses the package installer session to coax installation. Corporate exposure increases when unmanaged devices access email, VPN, SSO, or banking apps.
Permission escalation: the malware requests high-value Android capabilities, typically Accessibility Service access, screen capture or MediaProjection consent, overlay permission, notification listener access, SMS access, usage access, and ignore-battery-optimization. These permissions are the real payload.
Credential and PIN capture: Accessibility events, overlay windows, keylogging through accessibility node inspection, screen capture, and fake lock or verification screens harvest passwords, PINs, OTPs, recovery phrases, and session context.
On-device fraud: rather than only stealing credentials for later use, the trojan operates during the genuine banking session. It can hide UI elements, inject fields, read balances, alter payee data, auto-approve flows, suppress notifications, and drive transactions through the legitimate app while the victim sees a benign screen.
Remote operations: a command-and-control channel issues commands. The reported 167-command set implies granular operator control: collect device data, manage permissions workflow, open apps, simulate taps or gestures where accessibility allows, steal notifications, capture screens, update configuration, target specific packages, clean traces, or move laterally into crypto wallet flows.

The key defensive shift is that server-side fraud analytics may see a valid device, valid app version, valid session, valid biometric prompt, and a user who appears present. The compromise is in the device trust boundary. If your controls assume the handset is healthy, ToxicPanda-style on-device fraud defeats that assumption.

Detection and response

Android malware detection belongs in mobile threat defense, MDM compliance, EDR for Android, Play Protect signals, bank app risk SDK telemetry, proxy and DNS controls, and SOC correlation. The Sigma rules below intentionally target adjacent enterprise telemetry that many SOCs already collect: unauthorized ADB use, sideload artifacts on managed endpoints, and APK movement through controlled systems. They are not a substitute for Android MTD. They are tuned to catch lab detonation, help-desk misuse, compromised admin workstations, and staging that precedes device infection.

YAML

---
title: Unauthorized ADB Install or Permission Grant Activity
id: 4f8d9c2a-7b31-4e6d-9a1f-2c5b8e7a9012
status: experimental
description: Detects adb.exe used to install packages, grant runtime permissions, modify app ops, or enable accessibility-related settings from Windows systems. This can indicate sideloading, malware staging, unauthorized device manipulation, or compromised mobile-admin tooling.
references:
  - https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html
  - https://attack.mitre.org/techniques/T1476/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/08/07
tags:
  - attack.execution
  - attack.persistence
  - attack.t1476
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\adb.exe'
  selection_cmd:
    CommandLine|contains:
      - ' install '
      - ' install-multiple '
      - ' shell pm grant '
      - ' shell pm install '
      - ' shell appops set '
      - ' shell settings put secure enabled_accessibility_services'
      - ' shell settings put secure accessibility_enabled'
      - ' shell input tap '
      - ' shell input swipe '
  filter_devpaths:
    CommandLine|contains:
      - 'gradlew'
      - 'firebase'
      - 'appcenter'
  condition: selection_image and selection_cmd and not filter_devpaths
falsepositives:
  - Android developers, QA engineers, mobile device labs, and OEM support workflows
level: high
---
title: Suspicious APK Artifact Created on Managed Endpoint
id: 9a2e6d41-83c0-4a6b-b55d-71c0f2e83a19
status: experimental
description: Detects APK files created in user-writable locations by browsers, email clients, chat clients, archive tools, or script interpreters on managed Windows systems. Useful for finding mobile lure artifacts, detonation staging, or cross-platform delivery infrastructure.
references:
  - https://thehackernews.com/2026/08/toxicpanda-20-and-golddigger-expand.html
  - https://attack.mitre.org/techniques/T1566/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/08/07
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_name:
    TargetFilename|endswith: '.apk'
  selection_path:
    TargetFilename|contains:
      - '\Users\'
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  selection_source:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\teams.exe'
      - '\winrar.exe'
      - '\7z.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
  condition: selection_name and selection_path and selection_source
falsepositives:
  - Managed Android enterprise app distribution, mobile QA artifact storage, approved OEM tooling
level: medium

KQL — Microsoft Sentinel / Defender

// Hunt 1: ADB-driven installs, permission grants, accessibility changes, or UI automation from endpoints
let lookback = 14d;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where FileName =~ 'adb.exe'
| where ProcessCommandLine has_any (' install ', ' install-multiple ', ' shell pm grant ', ' shell pm install ', ' shell appops set ', ' enabled_accessibility_services', ' accessibility_enabled', ' shell input tap ', ' shell input swipe ')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256, ReportId
| order by TimeGenerated desc;

// Hunt 2: APK retrieval or egress visible in Defender network telemetry
let lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where RemoteUrl endswith '.apk' or RemoteUrl contains '.apk?'
| where InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','firefox.exe','outlook.exe','teams.exe','powershell.exe','curl.exe','wget.exe')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType
| order by TimeGenerated desc;

// Hunt 3: Proxy, firewall, or secure web gateway telemetry showing APK downloads outside approved stores
let lookback = 14d;
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where RequestURL endswith '.apk' or RequestURL contains '.apk?' or FileName endswith '.apk'
| extend UrlLower = tolower(RequestURL)
| where UrlLower !has 'play.google.com' and UrlLower !has 'apk.pure' and UrlLower !has 'your-approved-mobile-catalog.example'
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, FileName, RequestMethod, ApplicationProtocol, DeviceVendor, DeviceProduct
| order by TimeGenerated desc;

VQL — Velociraptor

-- Hunt managed Windows endpoints for ADB execution and staged APK artifacts
LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)adb\.exe$'
   OR CommandLine =~ '(?i)(pm grant|pm install|appops set|enabled_accessibility_services|input tap|input swipe|\.apk)'

LET apks = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/**/{Downloads,Desktop,AppData/Local/Temp,AppData/Roaming}/**/*.apk')
WHERE Mtime > now() - 1209600

SELECT 'process' AS ArtifactType, Pid AS Pid, Name AS Name, CommandLine AS Detail, Exe AS Path, Username AS Username, CreateTime AS TimeValue
FROM processes
UNION ALL
SELECT 'apk_file' AS ArtifactType, NULL AS Pid, NULL AS Name, FullPath AS Detail, FullPath AS Path, NULL AS Username, Mtime AS TimeValue
FROM apks
ORDER BY TimeValue DESC

Bash / Shell

#!/usr/bin/env bash
# Read-only Android banking-trojan triage for a connected, authorized device.
# Usage: ./android_triage.sh --device SERIAL --out /cases/odf-triage
# Optional: add --revoke to remove selected dangerous grants after legal/HR approval.
set -euo pipefail
DEVICE=''
OUT='./android-triage'
REVOKE=0
while [ $# -gt 0 ]; do
  case "$1" in
    --device) DEVICE="$2"; shift 2 ;;
    --out) OUT="$2"; shift 2 ;;
    --revoke) REVOKE=1; shift ;;
    *) echo 'unknown arg'; exit 1 ;;
  esac
done
ADB='adb'
[ -n "$DEVICE" ] && ADB="adb -s $DEVICE"
mkdir -p "$OUT"
$ADB get-state >/dev/null
$ADB shell getprop ro.product.model > "$OUT/device.txt"
$ADB shell getprop ro.build.version.release >> "$OUT/device.txt"
$ADB shell getprop ro.build.version.security_patch >> "$OUT/device.txt"
$ADB shell settings get secure enabled_accessibility_services > "$OUT/accessibility_services.txt"
$ADB shell settings get secure accessibility_enabled > "$OUT/accessibility_enabled.txt"
$ADB shell pm list packages -3 > "$OUT/third_party_packages.txt"
$ADB shell pm list packages -d > "$OUT/disabled_packages.txt" || true
$ADB shell dumpsys deviceadmin > "$OUT/device_admins.txt" || true
$ADB shell dumpsys notification --noredact > "$OUT/notification_listeners.txt" || true
$ADB shell dumpsys window | grep -i 'SYSTEM_ALERT_WINDOW\|type=TYPE_APPLICATION_OVERLAY' > "$OUT/overlay_windows.txt" || true
$ADB shell dumpsys usagestats > "$OUT/usage_access.txt" || true
$ADB shell cmd package query-activities --brief android.intent.action.VIEW -d https://example.invalid > "$OUT/intent_probe.txt" || true
while read -r pkg; do
  [ -z "$pkg" ] && continue
  $ADB shell dumpsys package "$pkg" > "$OUT/pkg_$pkg.txt"
  grep -E 'android.permission.(BIND_ACCESSIBILITY_SERVICE|SYSTEM_ALERT_WINDOW|READ_SMS|RECEIVE_SMS|READ_NOTIFICATIONS|REQUEST_INSTALL_PACKAGES|QUERY_ALL_PACKAGES|FOREGROUND_SERVICE|RECEIVE_BOOT_COMPLETED)' "$OUT/pkg_$pkg.txt" > "$OUT/risky_perms_$pkg.txt" || true
  if [ "$REVOKE" -eq 1 ]; then
    $ADB shell pm revoke "$pkg" android.permission.SYSTEM_ALERT_WINDOW 2>/dev/null || true
    $ADB shell pm revoke "$pkg" android.permission.READ_SMS 2>/dev/null || true
    $ADB shell pm revoke "$pkg" android.permission.RECEIVE_SMS 2>/dev/null || true
    $ADB shell pm revoke "$pkg" android.permission.REQUEST_INSTALL_PACKAGES 2>/dev/null || true
  fi
done < <(sed 's/package://g' "$OUT/third_party_packages.txt")
echo "Triage bundle written to $OUT. Escalate if accessibility_services.txt contains unknown packages or risky_perms_* is non-empty for non-bank apps."

Immediate remediation and hardening

First, treat confirmed or suspected infection as fraud in progress, not a malware cleanup ticket. Freeze affected banking or crypto sessions, invalidate refresh tokens, step-up re-enroll credentials from a known-clean device, review recent payee changes and device binding events, and inspect transactions completed during the exposure window. Because on-device fraud occurs inside an authenticated session, password resets alone are insufficient if the attacker captured session tokens, device-binding material, recovery phrases, or pushed through a transaction before containment.

For enterprises and financial institutions, enforce these controls now:

Block sideloading by policy. Require Play Integrity or equivalent attestation for app access, block unknown-sources installation on managed devices, and prevent work-profile access from devices with Play Protect failures, developer mode enabled, bootloader unlocked, or active unknown accessibility services.
Make Accessibility Service risk a tier-one detection. Alert when a non-allowlisted package holds BIND_ACCESSIBILITY_SERVICE, SYSTEM_ALERT_WINDOW, READ_SMS, notification listener, REQUEST_INSTALL_PACKAGES, QUERY_ALL_PACKAGES, usage access, or battery-optimization exemption. Accessibility plus overlay plus banking package targeting is a high-confidence fraud pattern.
Harden mobile app sessions. Bind sessions to device integrity, detect overlays and accessibility-driven automation, use transaction signing independent of the infected UI, re-verify payee changes out of band, risk-score new devices, and never let OTP or push approval be the only control for high-risk movement of funds.
Control delivery paths. DNS and proxy controls should block newly registered domains, URL shorteners to APKs, executable content from messaging lures, and direct APK downloads outside approved enterprise catalogs. Insecure direct APK delivery should be rare enough to alert on.
Secure administration and labs. Restrict adb to approved mobile engineering hosts, require just-in-time access, log adb use, and prevent analysts from detonating samples on production networks. The Windows rules above are there because mobile malware operations often touch enterprise infrastructure before they touch phones.
Customer and employee guidance must be specific: install only from Google Play or the official bank link typed manually; never grant Accessibility Service to a security tool, cleaner, rewards app, PDF reader, or browser update; treat any request to disable Play Protect, allow unknown apps, share screen, read notifications, or enter a PIN outside the bank app as hostile.

There is no vendor patch version to apply because no CVE is identified in the source reporting. The relevant official references are the Zimperium zLabs research discussed by The Hacker News, Google Play Protect and Play Integrity guidance, Android Enterprise management controls, and your bank or wallet provider's fraud response runbook. If you are a financial institution, map this to your fraud-loss threshold: any customer device with unknown accessibility services plus recent contact from an unverified bank channel should trigger proactive outreach before loss, not after.

SOC validation checklist

Before you consider coverage adequate, prove you can answer these questions from telemetry: which devices have an unknown accessibility service; which devices installed an APK outside Play; which banking or crypto packages were opened while screen capture, overlay, or accessibility automation was active; which sessions changed payees or limits within minutes of a new device signal; which endpoints executed adb install or pm grant outside an approved change window; and which proxy logs show APK downloads from infrastructure your org has never seen. If the answer depends on manual MDM exports, close that gap this quarter.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub