ToxicPanda Banking Malware Attacking Banking Users To Steal Logins

**ToxicPanda Banking Malware** — Cleafy observed an active campaign of the ToxicPanda Android banking trojan (evolved from TgToxic) targeting users across Europe and Latin America, infecting ~1,500 devices (majority in Italy) and using accessibility-service abuse, SMS/OTP interception, remote control, and C2 communication (domains: dksu.top, mixcom.one, freebasic.cn) to conduct fraudulent transactions up to €10,000.