Updated ToxicPanda Variant Targets 140+ Banking and Crypto Apps

Security researchers (zLabs) discovered ToxicPanda 2.0, a new Android banking trojan variant that greatly broadens its target set—adding PIN-theft for 140 banking/crypto apps and overlay-based credential theft for 349 financial institutions across multiple countries—and introduces advanced TTPs such as abusing the Android Accessibility Service to enable wireless debugging and ADB shell access, overlay attacks to steal lock-screen credentials, and persistence tactics; the report also recommends enterprise mitigations like blocking sideloading, treating accessibility grants as privileged events, and alerting on developer options/wireless debugging.