ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Security researchers disclosed updated Android banking trojans: ToxicPanda 2.0 expands to 167 remote commands, harvests PINs via overlays, abuses Android accessibility and Wireless Debugging (ADB) for privilege escalation, and uses AWS-hosted buckets for delivery; GoldDigger uses a sophisticated packer and accessibility abuse to conduct on-device fraud, stream audio/video, capture credentials, and has caused mass infections in South Africa and the U.K.