Android Botnet 'ToxicPanda' Bashes Banks Across Europe, Latin America

Researchers have identified ToxicPanda, a new Android banking trojan attributed to Chinese-speaking actors that has infected roughly 1,500 devices across Italy, Portugal, Spain, and Latin America and targets at least 16 financial institutions. ToxicPanda abuses Android accessibility services, captures OTPs (including from authenticator apps), enables remote control to perform fraudulent money transfers while bypassing multifactor protections, and includes code-hiding techniques; the report also highlights Google patches for two actively exploited Android flaws (CVE-2024-43047 and CVE-2024-43093).