GoKawiilToxicPanda banking trojan updated to abuse VPN permissions and block Google Play
Zimperium researchers found a new version of the ToxicPanda Android malware that requests VPN service permissions to intercept and control device network traffic, allowing it to cut off communication with Google Play and Play Protect. The updated trojan, spread via Amazon AWS-hosted buckets, now supports 167 remote commands and phishing overlays for 349 banking, crypto, and e-wallet apps across 16 countries, plus a separate module that harvests PINs from 140 financial apps.
GoKawiil's interpretation of the reporting above, not reported fact.
By hijacking VPN permissions, the malware can silently block Play Protect scans and security checks, making it far harder for Android's built-in defenses to detect or remove it. The addition of ADB automation, invisible overlays, and fake lock-screen and update prompts shows attackers are investing heavily in stealth and persistence, raising the stakes for mobile banking security worldwide.
- ToxicPanda 2.0 abuses VPN permissions to block Google Play and Play Protect communications.
- The malware now targets 349 financial apps with overlays and 140 apps with a dedicated PIN-stealing module.
- It automates ADB access and uses fake lock-screen and system update prompts to hide malicious activity.
YubiKey 5C NFC Security Key — When Android malware like ToxicPanda hijacks accessibility and network permissions to hijack accounts, a hardware security key keeps logins phishing-resistant because approval requires a physical tap. The YubiKey 5C NFC works over USB-C or by tapping the back of an Android phone, and it supports major accounts that offer FIDO2/WebAuthn sign-in.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-23
Published there as: “ToxicPanda Android malware uses VPN permissions to block Google Play”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.