ToxicPanda: a new banking trojan from Asia hit Europe and LATAM
Essential information
- Published
- 06/11/2024 11:19
- Modified
- 06/11/2024 11:36
- Tags
- 2024-11-06 accessibility abuse aes encryption android banking trojan c2 infrastructure chinese threat actors europe latin america on-device fraud tgtoxic toxicpanda
- Related entities
- 19 observables, 1 intrusion sets (apt), 2 malware, 7 others
Description
A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and on-device fraud. It can intercept OTPs, remotely control devices, and collect sensitive data. The malware uses AES encryption for C2 communication and has a sophisticated control panel. While less advanced than some trojans, ToxicPanda's expansion into new regions marks a significant shift in the threat landscape.