{
  "name": "ToxicPanda: a new banking trojan from Asia hit Europe and LATAM",
  "slug": "toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam",
  "description": "A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and on-device fraud. It can intercept OTPs, remotely control devices, and collect sensitive data. The malware uses AES encryption for C2 communication and has a sophisticated control panel. While less advanced than some trojans, ToxicPanda's expansion into new regions marks a significant shift in the threat landscape.",
  "published": "2024-11-06T10:19:36+00:00",
  "created_at": "2024-11-06T10:19:36+00:00",
  "modified_at": "2024-11-06T10:36:10+00:00",
  "created_at_opencti": "2024-11-06T10:19:36+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-11-06",
    "accessibility abuse",
    "aes encryption",
    "android",
    "banking trojan",
    "c2 infrastructure",
    "chinese threat actors",
    "europe",
    "latin america",
    "on-device fraud",
    "tgtoxic",
    "toxicpanda"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "mixcom.one"
      },
      {
        "id": "",
        "name": "mwscg.top"
      },
      {
        "id": "",
        "name": "kmpct.top"
      },
      {
        "id": "",
        "name": "fgta.lol"
      },
      {
        "id": "",
        "name": "freebasic.cn"
      },
      {
        "id": "",
        "name": "dpds.lol"
      },
      {
        "id": "",
        "name": "dksu.top"
      },
      {
        "id": "",
        "name": "dblxz.lol"
      },
      {
        "id": "",
        "name": "dbltest8.top"
      },
      {
        "id": "",
        "name": "dbltest.top"
      },
      {
        "id": "",
        "name": "dbltest6.top"
      },
      {
        "id": "",
        "name": "dblpap3.top"
      },
      {
        "id": "",
        "name": "dblpap2.top"
      },
      {
        "id": "",
        "name": "dblpap1.top"
      },
      {
        "id": "",
        "name": "ckysp.top"
      },
      {
        "id": "",
        "name": "cgtp.lol"
      },
      {
        "id": "",
        "name": "bnwu.lol"
      },
      {
        "id": "",
        "name": "atnp.lol"
      },
      {
        "id": "",
        "name": "99spedmart.me"
      }
    ],
    "malware": [
      {
        "id": "5547ce79-181b-4290-a065-5db4b11b28af",
        "name": "ToxicPanda",
        "slug": "toxicpanda"
      },
      {
        "id": "eb5a9888-5719-497f-8870-0686f04dd9e4",
        "name": "TgToxic",
        "slug": "tgtoxic"
      }
    ],
    "intrusion_sets": [
      {
        "id": "245c8294-1bac-4678-9294-b8a111ddfef8",
        "name": "ToxicPanda",
        "slug": "toxicpanda"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "Portugal"
      },
      {
        "id": "",
        "name": "Spain"
      },
      {
        "id": "",
        "name": "Italy"
      },
      {
        "id": "",
        "name": "Peru"
      },
      {
        "id": "",
        "name": "France"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.cleafy.com/cleafy-labs/toxicpanda-a-new-banking-trojan-from-asia-hit-europe-and-latam",
    "https://otx.alienvault.com/pulse/672b50c9a46bdbb1f1ddfb2c"
  ]
}