ToxicPanda 2.0 chains VPN, accessibility and local ADB to steal Android banking credentials

A dropper disguised as an installer

According to a Zimperium zLabs report published on 19 August 2026, ToxicPanda 2.0 is an Android banking trojan whose samples are distributed from Amazon Web Services-hosted storage. The exact lure used to convince victims to download the file is not public. Once launched, the dropper shows a fake installation screen and asks the user to approve an Android VPN connection. If granted, the local VPN blocks network traffic to Google Play and Google Play Services. The dropper then decrypts an encrypted payload stored in its own assets, installs it, and asks the user to enable the Accessibility Service.

Accessibility automation meets wireless debugging

The distinctive part of the attack is how it escalates. The Accessibility Service reads the Android settings interface and drives it as a user would. If Developer Options are disabled, it automatically taps "Build number" seven times to enable them. It then navigates to the Wireless Debugging screen, turns the feature on, opens the "Pair device with pairing code" dialog, and reads the six-digit pairing code and dynamic port shown on screen.

With those values, the malware pairs with the ADB daemon listening on 127.0.0.1 — the device's own loopback interface, not an externally exposed debug port — using SPAKE2/TLS. The result is ADB shell user privileges on Android 11 and later devices. Zimperium notes that the report shows no root access and no kernel exploit; shell access is enough. The malware runs commands to grant itself runtime permissions, relax background execution limits, enable components and establish persistence, sidestepping the permission prompts a normal app would face.

Overlays and a 167-command remote control channel

To find valuable targets, the malware sends package names and icons of installed apps to its command-and-control server to identify financial applications. When the user opens one, the server delivers a fake HTML screen that the malware displays over the real login or transaction flow. A transparent overlay captures touch positions to steal the app's PIN, and a separate fake lock screen harvests the device PIN, pattern or password. Zimperium also describes a fake system update screen that can be shown in front to hide background activity.

After an initial HTTPS request, the malware keeps an encrypted WebSocket connection open to receive commands and send back collected data. Zimperium counted 167 implemented remote actions, including taking screenshots, simulating input, stealing SMS messages and contacts, installing APKs and requesting Device Administrator rights — though implementation does not prove every command was used in real attacks.

What defenders can see

For administrators, Zimperium points to concrete signals. MDM and mobile threat defence tools can flag unauthorized app installations, unknown apps requesting VPN, Accessibility or Device Administrator rights, and unexpectedly enabled Developer Options or Wireless Debugging. On the network side, the main clues are AWS-hosted distribution URLs, traffic shifting from HTTPS to long-lived WebSocket connections that do not match normal use, and Zimperium's published indicators of compromise. Endpoint monitoring should watch for ADB shell commands such as "pm grant" and for WebView-based fake login screens. Zimperium notes that standard PC EDR products cannot see permission changes, screen overlays or local ADB pairing inside an Android device.

The chain breaks if device policies block apps from unknown sources, unauthorized VPNs, unvetted Accessibility services or debugging features — or if the user simply denies the early prompts and deletes the app.

Why it matters

ToxicPanda 2.0 shows that an unrooted device is no longer a meaningful boundary. By chaining three legitimate Android mechanisms — VPN service, Accessibility automation and wireless debugging pairing — the malware reaches shell-level control on a stock device using only approvals the user was tricked into giving. Every ingredient is a standard platform feature, which weakens signature-based detection and shifts the burden onto policy: block sideloading, restrict Accessibility and VPN grants to vetted apps, and disable Developer Options across managed fleets. The immediate targets are banking, crypto and payment apps, but as Zimperium's analysis acknowledges, the same overlay theft would capture any credential typed on an infected device, including corporate logins.