Cybersecurity researchers have shed light on an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally.
Zimperium zLabs, in a Wednesday report, said the Android malware also features a PIN harvesting workflow targeting more than 140 banking and cryptocurrency applications. ToxicPanda is known to be active in the wild since at least July 2022.
"By abusing the Android accessibility service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions [across 16 countries], compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities," security researcher Vishnu Pratapagiri said.
The new version also fleshes out some of the previously unimplemented commands, siphons lock screen credentials using a fake overlay, and introduces an automated click-based mechanism to abuse Android Wireless Debugging via Android Debug Bridge (ADB) to facilitate privilege escalation and shell-level access on compromised devices. It achieves this by using the accessibility services to enable Developer Options and turn on Wireless debugging.
ToxicPanda 2.0 connects to its command-and-control (C2) server by sending an initial HTTPS request to establish a bidirectional WebSocket communication channel to receive commands and exchange data. Like in the case of the newly-discovered Manic, the Android malware can display full-screen "system update" overlays to conceal its background actions and deploy an invisible transparent overlay to capture touch and harvest PIN codes.
Other newly added functionalities include a prompt to trick the victim into granting Device Administrator privileges, overwriting the device's local lock screen PIN or password with an attacker-defined value, and profiling the infected device to determine the OEM vendor and take appropriate steps to exempt the malware from battery optimization policies using accessibility services and ensure uninterrupted background execution.
"The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery," Zimperium said.
New GoldDigger Campaign Targets South Africa, U.K.
The third Android banking trojan to come under the security radar is GoldDigger, which was first documented by Group-IB in October 2023 as capable of carrying out on-device fraud. It's attributed to GoldFactory, a Chinese-speaking threat actor linked to other banking malware families targeting both Android and iOS, such as GoldPickaxe, GoldDiggerPlus, and GoldKefu.
According to IBM Trusteer, GoldDigger makes use of a sophisticated packer called "dpt-shell" to obfuscate its code and resources in an attempt to resist analysis. The packer also implements a bevy of evasion techniques: encrypting its native logic; detecting if Frida is attached to the process and, if so, crashing it; preventing external debuggers from attaching by marking itself as being traced using the PTRACE system call.
The current GoldDigger campaign mainly impersonates airline companies and shopping retailers, resulting in a "massive infection" in South Africa and the U.K. Victims who end up installing these apps are asked to grant accessibility services permissions, which the malware abuses for fraudulent actions.
"GoldDigger can inject input to the banking app to mimic user interaction, such as entering text, clicking buttons, and performing gestures," security researcher Shahar Tavor Lusky said. In doing so, GoldDigger initiates fraudulent transactions from the victim's banking app to the attacker."
GoldDigger can also give the operator real-time access to the victim's screen, capture credentials entered on banking apps using fake overlays, and run a targeted app within a virtual environment, giving the attacker full visibility into its runtime behavior and real-time interception of credentials and sensitive data.
For C2, the malware establishes a WebSocket connection to receive commands that allow it to request accessibility and location permissions; capture input from any app using the accessibility services; collect contacts and SMS messages; record audio and video and stream it using the RTMP protocol to the C2 server, open specific URLs; and open specific apps (e.g., Google Play Store and Settings).
To stay safe against these threats, it's advised to review installed applications and remove any unfamiliar or suspicious ones, audit app permissions before granting them, download apps only from trusted sources and developers, keep devices up-to-date, enable two-factor authentication (2FA) for all online accounts, and monitor bank accounts for unusual transactions.
