NewsBite analysis · Security · Security Vulnerability
BleepingComputer
ToxicPanda Android malware uses VPN permissions to block Google Play
The ToxicPanda Android malware has evolved by adding VPN service permissions that enable it to block access to Google Play and Google Play Services. This allows the malware to bypass security checks, install its payload, and gain control over various financial applications. Zimperium reports extensive targeting, including phishing for sensitive information across 349 apps and utilizing features to maintain persistent access on infected devices by exploiting the Android Debug Bridge (ADB). Such advancements highlight the increasing sophistication of mobile malware, posing significant risks to users and security.
Act nowConfidence: HighImmediate horizonCybersecurity risk: High
Published 23 Aug 2026, 14:50 UTC2 min read
Visit original article ↗Lead image — BleepingComputer
Summary
TL;DR
- ToxicPanda now targets 349 applications and accepts 167 remote commands.
- The malware requests VPN permissions to block Google Play communications.
- It includes PIN-harvesting modules for 140 financial and cryptocurrency apps.
- The use of invisible overlays captures touch inputs during user activity.
- The malware can spoof Android lock screens to capture devices' PINs and passwords.
Interesting facts
- It is being distributed through Amazon AWS-hosted buckets.
- The malware automates access using Android's Wireless Debugging Bridge (ADB), signaling a trend in malware capabilities.