ToxicPanda 2.0 Android Banking Trojan: Detection and Defense Against ADB Wireless Debugging Abuse Targeting 349 Financial Apps

Zimperium's zLabs team has documented a major evolution of the ToxicPanda Android banking trojan — and the scope expansion should get every fraud team and mobile security program's attention. ToxicPanda 2.0 now targets 349 financial institutions and has spread from its original European footprint into 16 countries, including expanded operations across Latin America and Asia. What was a regionally contained nuisance has become a globally distributed banking credential and on-device fraud operation.

The most technically significant change in this release is the malware's abuse of Android Wireless Debugging (ADB over Wi-Fi) to gain deeper device access. Combined with the family's established accessibility service abuse and overlay-based credential theft, this gives operators a materially expanded attack surface on compromised handsets — enabling on-device fraud (ODF) where transactions are initiated from the victim's own device, defeating many device-binding and behavioral-fraud controls that banks rely on.

If your organization operates a consumer banking app, a mobile payment product, or employs a BYOD workforce with mobile access to corporate resources, this campaign is directly relevant. Below is a practitioner-level breakdown of the threat, followed by detection engineering and hardening guidance.

Technical Analysis

What ToxicPanda 2.0 Is

ToxicPanda is an Android banking trojan first documented in late 2024, attributed with moderate confidence to Chinese-speaking operators. The 2.0 variant documented by Zimperium represents a significant retooling:

• Target list expansion: 349 financial applications, up from a relatively small European bank list. Coverage now spans banking apps, payment services, and cryptocurrency wallets across 16 countries.
• Geographic expansion: Originally concentrated in Italy, Portugal, Spain, and Latin America, the new variant shows broader targeting consistent with an operator scaling a fraud-as-a-service style operation.
• Deeper device control: Abuse of Android's Wireless Debugging feature to escalate from an installed malicious app to broader device-level interaction.

Attack Chain (Defender's View)

Based on the documented behavior, the kill chain looks like this:

1. Delivery: Side-loading via phishing pages, fake app store clones, and smishing lures impersonating legitimate banking or utility apps. ToxicPanda is not distributed via Google Play; installation requires the victim to enable installation from unknown sources.
2. Accessibility service abuse: Like most modern Android bankers, ToxicPanda requests Android Accessibility permissions. This grants it the ability to read screen content, perform gestures, auto-click through permission prompts, and conduct gesture-based on-device fraud.
3. Overlay injection: When a targeted banking app is launched, the malware renders a phishing overlay harvesting credentials and MFA factors.
4. Wireless Debugging abuse (new in 2.0): The malware leverages Android Wireless Debugging — the ADB-over-Wi-Fi feature intended for developers, typically listening on TCP/5555 or a dynamically assigned pairing port — to obtain deeper, shell-level style interaction with the device. This is the same technique family popularized by malware such as TgToxic and the ADB-exploiting worms that scan for exposed port 5555 listeners. From a fraud perspective, ADB-level access enables automated input injection, app instrumentation, and persistence beyond what an ordinary sideloaded APK can achieve.
5. Exfiltration & fraud execution: Harvested credentials and session material are relayed to operator C2 infrastructure, and on-device fraud transactions are initiated directly from the victim handset — inheriting the victim's device fingerprint and session trust.

Affected Platforms

• Platform: Android (all versions with Wireless Debugging support are potentially exposed; Wireless Debugging was introduced in Android 11 and expanded in later releases).
• Targets: 349 financial institution applications across 16 countries. Cryptocurrency wallets and payment apps are included in the target list.
• Not affected: Devices that only install from Google Play with Play Protect active and accessibility services locked down are substantially harder for this family to compromise — side-loading is a prerequisite.

Exploitation Status

This is confirmed, active, in-the-wild exploitation. Zimperium's zLabs published the analysis based on live samples observed in current campaigns. There is no CVE associated with this threat — it abuses legitimate, documented Android features (Accessibility Services and Wireless Debugging/ADB) rather than exploiting a patchable vulnerability. That distinction matters for defenders: there is no patch to deploy. Defense is configuration, policy, and detection.

Detection & Response

Mobile malware is notoriously under-instrumented in enterprise SOCs. Most organizations have zero telemetry from Android devices in their SIEM. The detection content below targets the observable artifacts that do cross into enterprise visibility: network connections consistent with ADB wireless debugging, developer tooling execution on managed endpoints that may indicate testing of the technique, and hunt logic for identifying exposed ADB listeners on your network segments.

Sigma Rules

The following rules target ADB abuse patterns observable on Windows endpoints (used by operators and in sandbox/detonation environments) and network-level indicators of wireless debugging activation. These are deliberately tight — ADB has legitimate developer use, so rules are scoped to the specific behaviors of interest.

---
title: ADB Wireless Debugging Enabled Via Command Line
id: 3f8a2b91-7c4e-4d1a-9b6e-2e5f8c1a9d34
status: experimental
description: Detects execution of ADB commands that enable TCP/IP (wireless) debugging mode or connect to a device over the network. ToxicPanda 2.0 and related Android bankers abuse Wireless Debugging for deeper device access; unexpected ADB TCP/IP activation outside developer teams warrants investigation.
references:
  - https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\adb.exe'
  selection_cmd:
    CommandLine|contains:
      - 'tcpip 5555'
      - 'connect '
      - 'pair '
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate Android developers enabling wireless debugging for testing
  - QA automation pipelines using ADB over network
level: medium
---
title: Network Connection to Android ADB Wireless Debugging Port
id: 8c1d4e72-5b3f-4a9c-b2d7-9f3e6a8c1b25
status: experimental
description: Detects outbound network connections to TCP port 5555, the default Android Debug Bridge (ADB) wireless debugging port. ToxicPanda 2.0 abuses Wireless Debugging for deep device access; port 5555 traffic from non-developer systems or to unusual destinations is suspicious.
references:
  - https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 5555
  filter_known_devtools:
    Image|endswith:
      - '\adb.exe'
      - '\studio64.exe'
      - '\emulator.exe'
  condition: selection and not filter_known_devtools
falsepositives:
  - Custom applications using port 5555 (verify baseline in your environment)
  - MDM or mobile testing infrastructure
level: high
---
title: ADB Execution From Non-Developer Path
id: 5e9b7c31-2d8f-4e6a-a1c4-7b2d9f5e3a68
status: experimental
description: Detects adb.exe executing from user-writable or temporary directories rather than standard Android SDK paths. Malware droppers and fraud tooling frequently bundle portable ADB binaries in non-standard locations to interact with connected or network-reachable Android devices.
references:
  - https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\adb.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\Downloads\'
      - '\ProgramData\'
  condition: selection_img and selection_path
falsepositives:
  - Users manually extracting platform-tools ZIP to Downloads (low frequency; tune per environment)
level: high

KQL — Microsoft Sentinel / Defender

This hunt query looks across process and network telemetry for ADB wireless debugging activity. It assumes Defender for Endpoint (DeviceProcessEvents / DeviceNetworkEvents) and optionally Syslog/CEF ingestion for Linux build hosts and network sensors. Run it as a 7-day lookback hunt first to baseline, then convert the tightest clause into an analytics rule.

// Hunt: ADB Wireless Debugging abuse indicators (ToxicPanda 2.0 technique family)
// Lookback: 7 days — baseline before converting to analytics rule
let Lookback = 7d;
let ADBPort = 5555;
// 1) Process execution enabling or using wireless ADB
let ProcessHits = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName =~ "adb.exe" or ProcessCommandLine has "adb"
| where ProcessCommandLine has_any ("tcpip 5555", "connect ", "pair ", "shell ", "install ")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| extend Source = "ProcessExecution";
// 2) Network connections to/from ADB wireless debugging port
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemotePort == ADBPort or LocalPort == ADBPort
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIP, RemotePort, LocalPort, ActionType
| extend Source = "NetworkConnection";
union ProcessHits, NetworkHits
| sort by Timestamp desc

Additional hunt for exposed ADB listeners on your network segments (via Syslog/CEF firewall ingestion):

// Hunt: Firewall/network telemetry showing connections to ADB port 5555
// Useful to identify compromised or misconfigured Android devices on corporate Wi-Fi
let Lookback = 7d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationPort == 5555 or SourcePort == 5555
| summarize ConnectionCount = count(),
            Sources = make_set(SourceIP, 20),
            Destinations = make_set(DestinationIP, 20)
            by DeviceAction, DestinationPort, bin(TimeGenerated, 1h)
| sort by ConnectionCount desc

Velociraptor VQL

For endpoint forensics on developer workstations or systems suspected of being used as fraud-operator staging machines, this artifact hunts for portable/bundled ADB binaries in suspicious locations and live ADB network listeners:

-- Hunt for ADB binaries in suspicious paths and active ADB network connections
-- Relevant to ToxicPanda 2.0 wireless-debugging abuse and operator staging

-- Part 1: Suspicious ADB processes and binaries in user-writable paths
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)adb'
   OR Exe =~ '(?i)(Temp|Roaming|Public|Downloads|ProgramData).*(adb)'

-- Part 2: Live network listeners/connections on ADB port 5555
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE LocalPort = 5555 OR RemotePort = 5555

Remediation & Hardening Script

Because the threat abuses a legitimate Android feature rather than a CVE, endpoint "remediation" centers on (a) ensuring developer tooling on Windows hosts isn't abused, and (b) blocking unexpected ADB traffic at the host and network layer. The following PowerShell audits for ADB listeners and applies a host firewall block on inbound TCP/5555 for systems that have no business speaking ADB:

# ToxicPanda 2.0 / ADB Wireless Debugging Abuse — Host Audit & Hardening
# Run as Administrator on managed Windows endpoints (non-developer systems)

# 1) Audit: check for any active connections or listeners on ADB port 5555
Write-Host "[*] Auditing TCP/5555 activity..." -ForegroundColor Cyan
$adbConns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -eq 5555 -or $_.RemotePort -eq 5555 }
if ($adbConns) {
    Write-Host "[!] ALERT: Active ADB-related connections found. Investigate immediately:" -ForegroundColor Red
    $adbConns | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess -AutoSize
    foreach ($c in $adbConns) {
        $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
        if ($proc) { Write-Host "    Process: $($proc.ProcessName) | Path: $($proc.Path)" -ForegroundColor Yellow }
    }
} else {
    Write-Host "[+] No TCP/5555 activity detected." -ForegroundColor Green
}

# 2) Audit: locate portable/bundled adb.exe copies outside the Android SDK
Write-Host "[*] Searching for adb.exe in user-writable locations..." -ForegroundColor Cyan
$searchPaths = @("$env:TEMP", "$env:APPDATA", "C:\Users\Public", "C:\ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -Filter "adb.exe" -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Host "[!] Suspicious ADB binary: $($_.FullName)" -ForegroundColor Yellow
    }
}

# 3) Harden: block inbound ADB wireless debugging traffic on non-developer hosts
# NOTE: Exclude legitimate Android developer workstations before deploying broadly.
$ruleName = "Block-Inbound-ADB-Wireless-Debug-5555"
if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName $ruleName `
        -Direction Inbound -Protocol TCP -LocalPort 5555 `
        -Action Block -Profile Any -Enabled True | Out-Null
    Write-Host "[+] Firewall rule created: inbound TCP/5555 blocked." -ForegroundColor Green
} else {
    Write-Host "[+] Firewall rule already present." -ForegroundColor Green
}

# 4) Verify: confirm the rule is active
Get-NetFirewallRule -DisplayName $ruleName | Format-Table DisplayName, Enabled, Direction, Action -AutoSize

Remediation

There is no vendor patch for this threat because no vulnerability is exploited — ToxicPanda 2.0 abuses legitimate Android functionality. Remediation is therefore policy- and control-driven:

For financial institutions and app developers:

1. Implement runtime application self-protection (RASP) / mobile app shielding in consumer banking apps: detect accessibility-service abuse, overlay injection, and screen-sharing at runtime. Zimperium, Promon, Guardsquare, and Build38 all address this class.
2. Detect and respond to on-device fraud signals server-side. Transactions initiated via accessibility-driven gestures or injected input have detectable telemetry differences (touch event sources, sensor data, gesture timing). Work with your fraud engineering team to instrument these signals — device binding alone is defeated by ODF.
3. Flag devices with Wireless Debugging enabled as a risk signal in your mobile app's device-integrity checks. Developer Options enabled + ADB over Wi-Fi active is a high-confidence risk indicator for a consumer banking user.

For enterprises with BYOD/MDM programs:

1. Enforce MDM policy blocking Developer Options and ADB on enrolled devices that access corporate resources. Both Android Enterprise and Samsung Knox support disabling developer mode and USB/wireless debugging.
2. Block sideloading: Enforce "install from unknown sources" restrictions via MDM. ToxicPanda requires sideloading — this single control breaks the delivery chain.
3. Restrict accessibility service grants to allow-listed applications via MDM policy.
4. Segment mobile device VLANs and alert on TCP/5555 traffic at the network layer (see KQL firewall hunt above).

For end users / awareness teams:

1. Never install apps from links delivered via SMS, WhatsApp, or email — only Google Play or the official vendor store.
2. Never grant Accessibility permissions to apps that are not accessibility tools.
3. Keep Developer Options and Wireless Debugging off unless actively developing.
4. Enable Google Play Protect and keep the device on current security patch levels.

Threat intelligence: Monitor Zimperium's published research for updated IOCs (C2 domains, package names, sample hashes) and ingest them into your EDR/proxy block lists: https://securityaffairs.com/197681/breaking-news/toxicpanda-2-0-gets-a-major-upgrade.html

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub