Active Exploitation Alert: ToxicPanda 2.0 and GoldDigger Banking Malware Escalate On-Device Fraud Against Android Users Globally

Executive Summary

This advisory provides an in-depth technical analysis of the latest Android banking malware campaigns involving ToxicPanda 2.0 and GoldDigger, both of which have recently evolved to enable highly sophisticated on-device fraud (ODF) attacks. These malware families leverage Android Accessibility Services, advanced evasion, and privilege escalation techniques to bypass traditional anti-fraud controls and execute fraudulent transactions directly from compromised devices. The campaigns are actively targeting financial institutions and end-users globally, with a concentration in Europe, Vietnam, and the broader APAC region. The rapid evolution of these threats underscores the urgent need for enhanced detection, user education, and robust mobile security controls.

Threat Actor Profile

Both ToxicPanda 2.0 and GoldDigger are operated by financially motivated cybercriminal groups with a demonstrated capability for rapid technical innovation and global campaign expansion. While no direct attribution to specific Advanced Persistent Threat (APT) groups has been established, the tactics, techniques, and procedures (TTPs) observed are consistent with organized cybercrime syndicates specializing in banking malware and mobile fraud. These actors exhibit a high degree of operational security, leveraging cloud infrastructure, obfuscation frameworks, and dynamic command-and-control (C2) infrastructure to evade detection and takedown efforts. The targeting patterns indicate a focus on regions with high mobile banking adoption and relatively less mature mobile security postures, such as Southeast Asia, Latin America, and parts of Europe.

Technical Analysis of Malware/TTPs

ToxicPanda 2.0

ToxicPanda 2.0 represents a significant evolution from its predecessor, incorporating a modular architecture with over 167 remote commands and a focus on automating on-device fraud. The infection chain typically begins with distribution via fake apps, phishing campaigns, and payloads hosted on Amazon AWS buckets. Upon installation, the dropper requests VPN permissions through a deceptive interface, then deploys the main payload.

The malware immediately seeks Accessibility Service permissions, which, once granted, enable it to perform overlay attacks, automate device navigation, and escalate privileges. Notably, ToxicPanda 2.0 abuses Android Debug Bridge (ADB) by programmatically enabling Developer Options and Wireless Debugging, pairing with the local ADB daemon, and escalating to shell-level access. This allows the malware to bypass user interaction requirements and gain persistent, high-privilege access.

Overlay attacks are dynamically generated for over 349 banking, e-wallet, and cryptocurrency apps across 16 countries. These overlays mimic legitimate login and transaction screens, harvesting credentials, PINs, and two-factor authentication (2FA) codes. The malware also deploys overlays to capture device unlock credentials, such as PINs, patterns, and passwords, enabling device lockout and further persistence.

C2 communication is maintained via persistent WebSocket connections over HTTPS, with payloads encrypted using AES-ECB. The command set includes functions for automating system dialog navigation (<catAllViewSwitch>), requesting Device Admin privileges (<admSet>), resetting device lock credentials (<admPwd>), bypassing OEM-specific power management (<autoBoot>), and dynamically updating targeted app lists (<replacePinTargets>).

Persistence is achieved by exploiting Accessibility Services to automate the disabling of battery optimization and auto-start restrictions, ensuring the malware remains active even after device reboots or system updates. Device Admin privileges are leveraged to prevent uninstallation and enable remote device locking or credential resets.

GoldDigger

GoldDigger is a rapidly evolving Android banking trojan first identified in Vietnam, now expanding into APAC and Spanish-speaking regions. It is distributed via fake websites impersonating Google Play and local organizations, with links propagated through smishing and phishing campaigns. Victims are tricked into enabling "Install from Unknown Sources" and granting Accessibility Service permissions.

The malware employs the VirBox Protector obfuscation framework, significantly complicating static and dynamic analysis and enabling evasion of many commercial mobile security solutions. Once installed, GoldDigger abuses Accessibility Services to achieve full visibility into user actions, including keylogging, credential harvesting, 2FA interception, and remote device control.

On-device fraud is executed by simulating legitimate user interactions, unlocking the device, and initiating fraudulent payments from the victim's own device. This approach bypasses device fingerprinting and behavioral analytics typically used by financial institutions to detect anomalous transactions. The malware is highly localized, supporting Vietnamese, Spanish, and Chinese languages, indicating a strategic focus on regional expansion.

C2 infrastructure is highly dynamic, with domains such as cskh[.]evnspa[.]cc, vietgov[.]cc, and hds6y[.]cc used for payload delivery and command execution. SHA256 hashes of known samples include c2b91a1d4b3d1dff21f280864c6c4d1ad79054ba6c68c8e453617320709230a1 and 139a5bcc92044e2e7c47aa28256218d92a37bed682b318a7b167abac6a1634bc, among others.

Both malware families map to multiple MITRE ATT&CK techniques, including T1216 (System Script Proxy Execution via Accessibility Service abuse), T1071.001 (Web Protocols for C2), T1546.001 (Event Triggered Execution via overlay attacks), and T1055 (Process Injection for privilege escalation).

Exploitation in the Wild

ToxicPanda 2.0 has been observed in active campaigns infecting over 4,500 devices globally, with a concentration in Europe and Latin America. Victims report unauthorized transactions, device lockouts, and persistent credential theft. The malware's ability to automate ADB-based privilege escalation and dynamically update targeted app overlays has enabled it to bypass many traditional mobile security controls.

GoldDigger infections have been confirmed in Vietnam, with rapid expansion into other APAC countries and Spanish-speaking regions. The use of highly convincing fake apps and localized phishing campaigns has resulted in widespread credential theft, 2FA bypass, and successful on-device payment fraud. The deployment of VirBox Protector has hindered detection and analysis, allowing the malware to remain active in the wild for extended periods.

Both malware families have demonstrated the ability to adapt to new security measures, update C2 infrastructure, and expand their targeting to new regions and financial applications. The use of on-device fraud techniques represents a significant escalation in the threat landscape, as transactions initiated from the legitimate device are far more difficult for financial institutions to detect and block.

Victimology and Targeting

ToxicPanda 2.0 primarily targets users of banking, e-wallet, and cryptocurrency apps in Europe, Latin America, and other regions with high mobile banking adoption. The malware's overlay attack templates cover over 349 financial applications, indicating a broad and opportunistic targeting strategy. Victims are typically lured through phishing campaigns, fake app stores, and malicious links distributed via SMS and social media.

GoldDigger initially focused on Vietnamese financial institutions and e-wallet providers but has rapidly expanded to target Spanish and Chinese language apps, reflecting a strategic pivot towards broader APAC and Latin American markets. The malware's localization features and use of region-specific phishing lures suggest a high degree of operational sophistication and adaptability.

Both malware families disproportionately impact users who enable "Install from Unknown Sources" and grant Accessibility Service permissions to untrusted apps. Financial institutions in targeted regions face increased risk of fraud losses, reputational damage, and regulatory scrutiny due to the advanced capabilities of these malware strains.

Mitigation and Countermeasures

To defend against ToxicPanda 2.0, GoldDigger, and similar Android banking malware, organizations should implement a multi-layered security strategy encompassing technical controls, user education, and threat intelligence integration.

Monitoring for the installation of apps from unknown sources and the granting of Accessibility Service permissions is critical. Security teams should deploy mobile threat defense solutions capable of detecting overlay attacks, Accessibility Service abuse, and abnormal device automation. Blocking known C2 and malware delivery domains, as identified in the IOC lists, will disrupt active infection chains and limit malware persistence.

Behavioral analytics should be enhanced to detect anomalous transaction patterns indicative of on-device fraud, such as rapid credential entry, device unlocks preceding transactions, and transactions initiated from new or unexpected geolocations. Financial institutions should consider implementing out-of-band authentication mechanisms and device attestation to further mitigate the risk of ODF.

User education remains a cornerstone of defense. Organizations must regularly inform users about the risks of enabling "Install from Unknown Sources" and granting Accessibility permissions to untrusted applications. Clear guidance on recognizing phishing attempts, fake app stores, and suspicious permission requests will reduce the attack surface.

Incident response plans should be updated to include procedures for identifying and remediating mobile malware infections, including forensic analysis of compromised devices, credential resets, and notification of affected users.

References

About Rescana

Rescana delivers advanced third-party risk management (TPRM) solutions, empowering organizations to proactively identify, assess, and mitigate cyber risks across their digital supply chains. Our platform leverages real-time threat intelligence, automated risk scoring, and continuous monitoring to provide actionable insights and enhance organizational resilience. For more information or to discuss how Rescana can support your cybersecurity strategy, please contact us at info@rescana.com.