ToxicPanda 2.0 Targets 349 Financial Apps and Steals Android Lock Credentials
Zimperium’s zLabs team has identified ToxicPanda 2.0, an updated Android banking trojan capable of targeting hundreds of financial apps while giving its operators deeper control over infected phones.
The new version supports 167 remote commands and phishing overlays for 349 banking, financial, e-wallet and cryptocurrency apps in 16 countries. Its PIN-stealing system separately monitors more than 140 banking and cryptocurrency apps. The earlier ToxicPanda variant supported overlays for only 16 banking apps.
How ToxicPanda 2.0 Infects Android Phones
ToxicPanda 2.0 arrives as a dropper that displays a fake installation screen and asks the user for VPN permission. It uses that access to block communications from Google Play and Google Play Services, then decrypts and installs the main payload hidden inside the app.
After installation, the trojan requests access to Android’s Accessibility Service. This legitimate feature helps people interact with their devices, but malware can abuse it to read screen content,...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
