ToxicPanda Android Banking Trojan Abuses VPN Permissions and Blocks Google Play — Detection and Response Guide

The ToxicPanda Android banking trojan — a family we've tracked since its emergence as a TgToxic offshoot targeting banking and financial apps across Europe, Asia, and Latin America — has shipped a significant capability upgrade. According to the latest reporting, the malware now targets 349 applications, supports 167 distinct remote commands from its command-and-control infrastructure, and — most notably for defenders — abuses Android's VPN service permissions to intercept traffic and actively block access to Google Play and Play Protect.

That last behavior is the headline. By standing up a local VPN interface, ToxicPanda gains a man-in-the-middle position over the device's network traffic without ever compromising TLS at the endpoint — and it uses that position to prevent the victim from reaching the one tool that might remove it: Google's own on-device protection. Combined with its established abuse of Accessibility Services for overlay attacks, credential theft, and self-permission-granting, this is a mature, operationally dangerous banking trojan that is actively being distributed through sideloaded APKs and droppers masquerading as legitimate apps.

If your organization allows BYOD Android devices to access corporate email, SaaS applications, or VPN infrastructure, treat this as an active exposure, not a consumer problem.

Technical Analysis

What ToxicPanda Does in Its Current Iteration

Based on the reported analysis, the evolved ToxicPanda variant exhibits the following behaviors:

• Massive target expansion: 349 applications in scope, spanning banking, fintech, payment, cryptocurrency wallet, and social media apps. Overlay injection templates are fetched dynamically from C2, meaning the operator can add new targets without shipping an APK update.
• 167 remote commands: The C2 protocol supports an extensive command set covering keylogging, screen capture, SMS interception (for OTP/2FA theft), contact exfiltration, app launching, overlay injection, device administration, and remote-control operations (VNC-style interaction via Accessibility).
• VPN service abuse: The malware requests BIND_VPN_SERVICE and routes device traffic through a malicious local VPN. This accomplishes two goals: (1) traffic interception and potential credential harvesting, and (2) selective blocking of connections to Google Play and Play Protect endpoints, blinding Google's on-device scanning and preventing the user from installing or updating security apps.
• Accessibility Services abuse: The trojan solicits Accessibility permissions under deceptive pretenses, then uses them to auto-grant additional permissions, read screen content, intercept gestures, and block uninstallation attempts.
• Distribution: Sideloading via phishing pages, droppers posing as legitimate apps (browser updates, banking apps, utility tools) distributed outside Google Play — a critical detail, because it means devices restricted to Play Store installs are substantially less exposed.

Why VPN Permission Abuse Matters Defensively

Android's VpnService API gives an app the ability to route all device traffic through an interface it controls. Legitimate uses (corporate VPN clients, DNS-filtering apps) are common, which is precisely why this is effective — the permission prompt doesn't look anomalous to users. But on a managed or monitored device, an unexpected VPN service is a high-fidelity indicator: the population of apps that should ever hold BIND_VPN_SERVICE on a corporate device is small, enumerable, and definable as an allowlist. That makes this one of the most detectable behaviors in the malware's arsenal.

Similarly, blocking Play Protect requires the malware to interfere with connectivity to Google infrastructure — behavior observable both on-device (netlog / firewall anomalies) and at the network egress layer for devices on corporate Wi-Fi.

Exploitation Status

This is confirmed in-the-wild active malware, not a theoretical capability. ToxicPanda campaigns are ongoing and geographically expanding. No CVE is associated with this threat — it exploits Android's legitimate permission model and user social engineering, not a software vulnerability. There is no CISA KEV entry; defense is entirely about policy, detection, and user-side hardening.

Detection & Response

Android telemetry is the perennial SOC challenge: most organizations have deep Windows visibility and near-zero mobile visibility. The detections below are built around what is actually observable — MDM/EDR telemetry ingested into Sentinel (Microsoft Defender for Endpoint on Android, Intune compliance data), network egress logs, and forensics on connected workstations where ADB or sideloading occurred.

Sigma Rules

---
title: Non-Allowlisted Android VPN Service Installed on Corporate Device
id: 3f8c2e71-9b4a-4d5e-a6f1-7c2d8e9f0a1b
status: experimental
description: Detects installation or activation of a VPN service application on a managed Android device that is not on the corporate allowlist. ToxicPanda abuses BIND_VPN_SERVICE to intercept traffic and block Google Play/Play Protect. Tune the allowlist to your approved VPN/MDM/DNS-filtering apps.
references:
  - https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1572
logsource:
  product: android
  category: application
  service: package_manager
detection:
  selection_vpn_permission:
    AppPermissions|contains: 'android.permission.BIND_VPN_SERVICE'
  filter_allowlist:
    PackageName|contains:
      - 'com.google.android.gms'
      - 'com.microsoft.intune'
      - 'com.microsoft.defender'
      - 'net.openvpn.openvpn'
      - 'com.wireguard.android'
      - 'com.cisco.anyconnect'
      - 'com.zscaler'
      - 'com.paloaltonetworks.globalprotect'
  condition: selection_vpn_permission and not filter_allowlist
falsepositives:
  - Legitimate consumer VPN apps installed by users on BYOD devices (enforce policy via MDM rather than suppressing the rule)
  - New corporate VPN clients not yet added to the allowlist
level: high
---
title: Android Accessibility Service Enabled by Non-System Package
id: 8a1d4f62-2c7b-4e9a-b3d5-5f6a7b8c9d0e
status: experimental
description: Detects a non-system, non-allowlisted package registering an Android Accessibility Service. ToxicPanda and most modern Android bankers abuse Accessibility Services for overlay injection, auto-granting permissions, keylogging, and blocking uninstallation. Extremely high-fidelity when paired with sideloaded package detection.
references:
  - https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/
  - https://attack.mitre.org/techniques/T1629/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1629
logsource:
  product: android
  category: application
  service: accessibility
detection:
  selection:
    EventType: 'AccessibilityServiceEnabled'
  filter_system:
    PackageName|startswith:
      - 'com.google.android'
      - 'com.android'
      - 'com.samsung'
      - 'com.miui'
      - 'com.microsoft'
  condition: selection and not filter_system
falsepositives:
  - Legitimate accessibility tooling (password managers, screen readers) — maintain an organizational allowlist
level: high
---
title: APK Sideloaded via ADB from Windows Workstation
id: 1b5e9c34-6d8f-4a2b-9e7c-2d3e4f5a6b7c
status: experimental
description: Detects use of Android Debug Bridge on a Windows workstation to install an APK onto a connected device. Attackers distributing ToxicPanda rely on sideloading; ADB installs on endpoints where mobile development is not expected can indicate malicious staging or a compromised user installing 'update' APKs at an attacker's direction.
references:
  - https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.initial_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\adb.exe'
  selection_cli:
    CommandLine|contains:
      - ' install '
      - '.apk'
  filter_dev_hosts:
    User|contains:
      - 'REPLACE_WITH_MOBILE_DEV_GROUP'
  condition: selection_image and selection_cli and not filter_dev_hosts
falsepositives:
  - Mobile development teams and QA engineers — scope with a dev-workstation allowlist or exclude by host group
level: medium

KQL Hunt — Microsoft Sentinel / Defender

The following hunt assumes you ingest Microsoft Defender for Endpoint for Android and/or Intune device data into Sentinel. It surfaces managed Android devices where a non-allowlisted app holds VPN capability or where Play Protect has been disabled — the two behaviors that define this ToxicPanda variant. The second section pivots to workstations for ADB sideload staging.

// Hunt 1: Android devices with non-allowlisted VPN-capable apps or disabled Play Protect
// Requires MDE-for-Android / Intune ingestion. Tune the allowlist to your org's approved VPN/MDM agents.
let ApprovedVpnApps = dynamic([
  "com.google.android.gms", "com.microsoft.intune", "com.microsoft.defender",
  "net.openvpn.openvpn", "com.wireguard.android", "com.cisco.anyconnect",
  "com.zscaler", "com.paloaltonetworks.globalprotect"
]);
DeviceInfo
| where TimeGenerated > ago(7d)
| where OSPlatform startswith "Android"
| summarize arg_max(TimeGenerated, *) by DeviceId
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has_any ("vpn", "tun") or ProcessCommandLine has_any ("vpnservice", "BIND_VPN_SERVICE")
  ) on DeviceId
| where not(FileName has_any (ApprovedVpnApps))
| project TimeGenerated, DeviceName, OSPlatform, FileName, ProcessCommandLine, InitiatingProcessAccountName
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, FileName, ProcessCommandLine;
// Hunt 2: Workstations staging APKs or invoking ADB install (sideload staging)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "adb.exe" and ProcessCommandLine has "install" and ProcessCommandLine has ".apk"
| project TimeGenerated, DeviceName, ProcessCommandLine, FolderPath, InitiatingProcessAccountName, SHA256
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Commands = make_set(ProcessCommandLine, 5) by DeviceName, InitiatingProcessAccountName;

Velociraptor VQL — Sideload Staging on Endpoints

Velociraptor doesn't run on Android devices themselves, but ToxicPanda's distribution chain touches your managed estate when users stage APKs via workstations or when droppers are downloaded to a desktop before transfer. This hunt finds ADB execution, recently written APK files, and active USB/network connections associated with device transfer.

-- Hunt for ADB sideload activity and staged APK files on Windows endpoints
-- Relevant to ToxicPanda distribution chains where droppers/APKs transit corporate workstations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)adb'
   OR CommandLine =~ '(?i)\.apk'

-- Enumerate recently created/modified APK files outside known dev directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/**/*.apk')
WHERE Mtime > now() - 1209600
  AND NOT FullPath =~ '(?i)(android studio|sdk|gradle|appium)'
ORDER BY Mtime DESC

Triage & Inventory Script — ADB-Based Device Audit

For incident response or proactive fleet spot-checks, the following Bash script audits a USB-connected Android device for the exact permission combinations ToxicPanda depends on: non-allowlisted VPN services, third-party Accessibility Services, packages installed from outside the Play Store, and the state of Play Protect.

#!/bin/bash
# toxicpanda_triage.sh — Audit a connected Android device for ToxicPanda-relevant indicators
# Requires: adb, USB debugging authorized. For IR use on consented devices only.

ALLOWED_VPN="com.google.android.gms|com.microsoft.intune|com.microsoft.defender|net.openvpn.openvpn|com.wireguard.android|com.cisco.anyconnect"

echo "=== [1] Packages holding BIND_VPN_SERVICE (non-allowlisted = SUSPICIOUS) ==="
adb shell cmd package query-services -a android.net.VpnService 2>/dev/null | grep -i service || \
adb shell dumpsys package | grep -B2 "android.permission.BIND_VPN_SERVICE" | grep -vE "$ALLOWED_VPN"

echo "=== [2] Enabled Accessibility Services (non-system = REVIEW) ==="
adb shell settings get secure enabled_accessibility_services

echo "=== [3] Packages NOT installed by Google Play (sideload candidates) ==="
for pkg in $(adb shell pm list packages -3 | sed 's/package://'); do
  installer=$(adb shell cmd package get-installer "$pkg" 2>/dev/null || adb shell pm get-installer "$pkg" 2>/dev/null)
  echo "$installer" | grep -q "com.android.vending" || echo "SIDELOADED: $pkg  (installer: $installer)"
done

echo "=== [4] Play Protect / Verify Apps state (0 = DISABLED = SUSPICIOUS) ==="
adb shell settings get global package_verifier_enable
adb shell settings get secure package_verifier_user_consent

echo "=== [5] Active VPN interface (tun0 present while no approved VPN running = REVIEW) ==="
adb shell ip addr show tun0 2>/dev/null || echo "No active tun0 interface"

echo "=== [6] Unknown sources / install-unknown-apps grants ==="
adb shell settings get secure install_non_market_apps 2>/dev/null
adb shell appops get android:request_install_packages 2>/dev/null | head -30

Any device flagged by sections 1, 3, or 4 should be isolated from corporate resources immediately and imaged/reset — ToxicPanda's Accessibility-based self-protection makes partial cleanup unreliable.

Remediation

There is no patch for ToxicPanda because there is no CVE — it weaponizes legitimate Android features and user deception. Remediation is therefore architectural and procedural:

For infected devices (confirmed or suspected):

1. Isolate immediately. Remove the device from corporate Wi-Fi, revoke its sessions (Entra ID / Google Workspace / Okta), and revoke any OAuth grants and enrolled certificates. ToxicPanda's 167-command set includes session token and OTP theft — assume all credentials used on the device are compromised and force resets for banking, email, and corporate SSO.
2. Factory reset is the only reliable remediation. The malware uses Accessibility permissions to block uninstallation and maintain persistence. Boot into safe mode if you need to capture forensic artifacts first (package list, installer sources, Accessibility config, VPN profile), then wipe and re-enroll.
3. Monitor for financial fraud. ToxicPanda is a banking trojan — notify affected users to contact their financial institutions, review recent transactions, and rotate banking credentials from a clean device.

For the fleet (prevention and policy):

• Block sideloading via MDM. On corporate and COPE devices, enforce install_unknown_sources denial and disallow USB debugging. ToxicPanda's distribution depends entirely on out-of-Play installs — this single control neutralizes the delivery vector.
• Enforce an app allowlist (or at minimum a VPN-app allowlist) through Intune, Workspace ONE, or your EMM. Alert on any package requesting BIND_VPN_SERVICE or Accessibility access outside the allowlist.
• Require Play Protect and device certification in your conditional access policy. Devices failing Play Integrity verdicts should get zero corporate access — and ToxicPanda's deliberate Play Protect blocking will trip this signal, turning its own evasion into a detection.
• Deploy an MTD/EDR agent on Android (Microsoft Defender for Endpoint, Lookout, Zimperium, or equivalent) and actually ingest the telemetry into your SIEM. The KQL above is useless without it.
• User education: the entry point is a phishing page pushing an "update" or "banking app" APK. Brief users that no legitimate bank, browser, or Google service distributes updates outside the Play Store.

Network-level compensating controls:

• For devices on corporate Wi-Fi, alert on Android clients where expected Google Play/Play Protect egress traffic (play.googleapis.com, gmscompliance-pa.googleapis.com, Safe Browsing endpoints) suddenly drops to zero while general traffic continues — consistent with VPN-level blocking.

Response deadline: There is no CISA mandate here, but our guidance is to treat confirmed ToxicPanda infections as same-day credential-compromise incidents. The 24–72 hour fraud window after banking credential theft is when attackers monetize.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub