ToxicPanda Blocked Google Play, Then Paired With ADB From Inside the Phone.
ToxicPanda 2.0 does not rely on one spectacular Android flaw. It chains legitimate platform features until an attacker-controlled application can isolate Google services, automate security-sensitive settings and reach the device’s local Android Debug Bridge.
Zimperium’s zLabs team says the updated banking Trojan first asks the victim to approve a VPN service. It uses that position to block communications from Google Play and Google Play Services, then installs its main payload and asks for Accessibility Service access.
That is only the beginning of the control path. With Accessibility active, the malware can navigate through Android settings, enable Developer Options, turn on Wireless Debugging, open the pairing dialogue, read the six-digit code and dynamic port, and pair itself with the ADB daemon listening on the same phone.
The result is shell-level capability obtained through a sequence of user-approved and system-provided functions. It is not root access, and it is not a remote zero-click exploit. It is still a material step beyond the normal application sandbox.
The first control is network isolation
ToxicPanda 2.0 operates as a dropper. According to Zimperium’s technical analysis, it presents a fake installation interface in a WebView and prompts the user to grant VPN permission. The malware then creates a local network-control point and blocks communication from Google Play and Google Play Services.
A VPN permission is normally associated with privacy or secure remote access. On Android, however, a local VPN can also decide which traffic is allowed to leave the device. That makes it a useful isolation mechanism for malware.
The important point is the sequence. ToxicPanda does not wait until the full payload is established before interfering with a trusted service path. It obtains network control first, cuts the device off from Google services, and only then extracts and installs the main payload.
Zimperium has not claimed that the VPN step permanently defeats every Google Play security control. The verified fact is narrower: the dropper blocks communications belonging to Google Play and Google Play Services while preparing the next stage. Operationally, that can reduce the platform’s opportunity to check, update or respond during a critical part of the installation chain.
Accessibility becomes the automation layer
Accessibility Service access is the bridge between a malicious application and Android’s visible user interface. It can expose UI elements, observe foreground activity and perform gestures on the user’s behalf. Banking malware has abused this capability for years to capture credentials, approve prompts and operate financial applications directly on an infected device.
ToxicPanda 2.0 uses it as a general system-automation layer. The malware can inspect interface hierarchies, locate controls by their displayed labels and simulate the taps needed to change settings. Zimperium says it includes vendor-specific logic for Xiaomi, OPPO, Vivo, Samsung and Huawei devices, allowing it to navigate battery-optimisation and auto-start controls that would otherwise limit persistence.
The published command inventory contains 167 remote commands. They cover screenshots, gestures, overlays, application installation, camera access, screen streaming, device administration, permission handling and ADB operations. Several functions that were placeholders in the malware documented in 2024 are now implemented.
This matters because the new variant is not simply adding more phishing templates. It is turning Accessibility into the orchestration layer for a wider control system.
A six-digit code becomes local shell access
Wireless Debugging has been available since Android 11. Google’s developer documentation describes a deliberate pairing process: enable Developer Options, turn on Wireless Debugging and authorise a workstation using a six-digit code or QR code.
ToxicPanda automates the code path from inside the phone:
- It opens the device information screen and taps the build number repeatedly to unlock Developer Options.
- It navigates to the development settings and enables Wireless Debugging.
- It opens the pairing-code dialogue and reads the generated code and port from the interface hierarchy.
- It creates its own key pair and uses the code to complete the SPAKE2 pairing exchange with the local ADB service on
127.0.0.1. - It connects as the Android shell user and begins issuing ADB commands.
The security prompt is still present. The malware’s innovation is to become both sides of the interaction. Accessibility manipulates and reads the trusted interface, while the application acts as the development workstation that consumes the pairing secret.
The shell user is not root, but it changes the boundary
Calling the result “root access” would overstate the research. The ADB shell identity has broad debugging and system-management capabilities, but it is not equivalent to the Linux root user and remains constrained by Android’s security model and device build.
It is nevertheless much more powerful than an ordinary third-party application. Zimperium says ToxicPanda uses the shell context to grant permissions, neutralise background restrictions, enable components and strengthen persistence. The command set also includes arbitrary ADB shell execution, simulated taps and key events, screenshots, UI-tree inspection and ADB-based screen streaming.
This is the strategic issue. The application does not escape the sandbox through a memory-corruption vulnerability. It convinces legitimate platform features to assemble a more privileged execution path on its behalf.
The targeting has expanded far beyond the original campaign
Cleafy’s original 2024 investigation described an early-stage family associated with more than 1,500 infected devices. Italy accounted for more than half of the observed infections, followed by Portugal, Spain, France and Peru. The campaign targeted 16 banking institutions and used on-device fraud to operate accounts from the victim’s own phone.
Zimperium’s new samples show a much larger technical target set. ToxicPanda 2.0 supports phishing overlays for 349 banking, payment, e-wallet and cryptocurrency applications across 16 countries. A separate PIN-harvesting module monitors more than 140 financial and cryptocurrency applications and can receive updated target lists from its command-and-control infrastructure.
The malware can also imitate the Android lock screen to collect PINs, patterns and passwords. Some samples display fake system-update screens while malicious activity continues in the background. Distribution has shifted to payloads hosted in Amazon Web Services buckets, although the public research does not provide a current victim count or establish that every published command has been used against every target.
This is not a zero-click Android compromise
The prerequisites should remain prominent. The victim must receive and install a malicious application outside the normal trusted path, then approve powerful permissions or allow the malware to manipulate the required prompts. VPN and Accessibility access are not granted silently to an ordinary application.
That limits the initial-access story, but it does not make the later capability unimportant. Mobile malware campaigns are built around deception. Once a victim accepts the first convincing prompt, the operator’s objective is to convert that decision into durable control while reducing the number of additional decisions the victim must make.
ToxicPanda’s chain does exactly that. One permission controls network reachability. Another turns the interface into an automation API. Wireless Debugging then supplies a local shell path. Device-administrator and OEM-specific controls extend persistence and lock-screen manipulation.
What defenders should do
- Treat unfamiliar VPN and Accessibility requests as a combined warning. Either permission deserves scrutiny. A side-loaded application requesting both should be treated as a high-risk event, particularly when it is presenting an installation or system-update interface.
- Monitor Developer Options and Wireless Debugging. Enterprise mobility controls should flag or prohibit unexpected activation on managed devices. Review paired ADB hosts and revoke debugging authorisations when the feature is not required.
- Use the published indicators. Zimperium has released sample hashes, package information and infrastructure indicators in its ToxicPanda repository. Match them against mobile threat telemetry, DNS and proxy records, and application inventories.
- Block unapproved sideloading. Restrict installation from unknown sources on managed devices and investigate applications delivered through links, messaging platforms or cloud-storage buckets rather than an approved store.
- Look for the sequence, not one indicator. VPN registration followed by loss of Google-service connectivity, Accessibility activation, Developer Options changes, wireless ADB pairing and battery-optimisation exceptions is much stronger evidence than any one event alone.
- Keep fraud controls independent of the phone. Banks and payment providers should treat device-local approval, screen interaction and even valid credentials as potentially attacker-operated. Transaction-risk controls, beneficiary checks and out-of-band intervention remain necessary when on-device fraud is possible.
The trusted features are the attack chain
ToxicPanda 2.0 is consequential because each component of the chain looks legitimate in isolation. VPN services route traffic. Accessibility operates interfaces. Developer Options expose diagnostic controls. ADB pairs an authorised development host with a phone.
The failure appears when an attacker-controlled application can obtain the required user trust, automate both sides of the pairing process and combine those capabilities faster than the user or platform can intervene.
The defensive question is therefore not only whether an Android application has exploited a vulnerability. It is whether a sequence of individually permitted actions has created an execution path that no legitimate application should need.
Sources and further reading
- Zimperium zLabs: The ToxicPanda Never Sleeps, 19 August 2026
- Zimperium: ToxicPanda 2.0 indicators and command inventory
- Cleafy Labs: ToxicPanda, a new banking Trojan from Asia hit Europe and LATAM, 4 November 2024
- Android Developers: Run apps on a hardware device and use wireless debugging
- BleepingComputer: ToxicPanda Android malware uses VPN permissions to block Google Play, 23 August 2026
The Android robot is reproduced from work created and shared by Google and used according to the terms described in the Creative Commons 3.0 Attribution License. Android is a trademark of Google LLC.
