ToxicPanda 2.0 and GoldDigger broaden Android banking fraud
Researchers have detailed upgraded Android banking malware operations involving ToxicPanda 2.0, also known as TgToxic, and GoldDigger. Zimperium zLabs says ToxicPanda 2.0 has 167 remote commands and targets more than 140 banking and cryptocurrency apps through a PIN-harvesting workflow. Its broader overlay-based credential theft capability reaches 349 financial institutions in 16 countries, compared with 16 banking applications in the earlier version.
IBM Trusteer separately reported that a current GoldDigger campaign, attributed to the Chinese-speaking GoldFactory group, is impersonating airlines and shopping retailers. The activity has resulted in what the researchers describe as a massive infection in South Africa and the UK. GoldDigger was first documented by Group-IB in October 2023 as malware capable of on-device fraud.
ToxicPanda expands access and credential theft
ToxicPanda has been active since at least July 2022. The updated malware abuses Android accessibility services to collect UI elements visible on the screen and present overlays designed to steal credentials. It can show a full-screen system-update overlay to hide background activity, while an invisible transparent overlay captures touches and PIN codes.
The malware also includes a fake overlay for collecting lock-screen credentials and a prompt intended to obtain Device Administrator privileges. It can replace a device’s local lock-screen PIN or password with a value selected by the attacker. To preserve background execution, it profiles the device’s OEM vendor and uses accessibility services to seek exemption from battery-optimization policies.
A further capability automates clicks to enable Developer Options and Wireless Debugging, allowing abuse of Android Debug Bridge for privilege escalation and shell-level access. ToxicPanda begins command-and-control communications with an HTTPS request, then establishes a bidirectional WebSocket channel for commands and data exchange. Zimperium also observed samples delivered through Amazon AWS-hosted buckets.
GoldDigger enables transactions inside banking apps
GoldDigger uses a packer named dpt-shell to obscure its code and resources. IBM Trusteer said the packer encrypts native logic, detects Frida and crashes when it is attached, and blocks external debuggers by using the PTRACE system call to mark itself as traced.
After a victim installs an impersonating app and grants accessibility permissions, GoldDigger can inject text, clicks and gestures into a banking application, mimicking user interaction to start fraudulent transactions. It can also provide operators real-time screen access, use fake overlays to capture banking credentials, and execute a selected application in a virtual environment to observe its runtime and intercept sensitive data.
Its WebSocket-based command channel can request accessibility and location permissions, collect contacts and SMS messages, capture input from any app, and open URLs or apps such as Google Play Store and Settings. It can also record and stream audio and video to its command server using RTMP. The growth of mobile abuse follows patterns seen in SIM farms and device-focused attack chains, where SIM farms and device-focused attack chains illustrated the operational value attackers place on endpoints.
Practical implication for mobile security
Businesses should ensure employees review installed applications, remove unfamiliar software, scrutinize permission prompts and install apps only from trusted developers. Keeping devices updated, enabling two-factor authentication for online accounts and monitoring banking activity for unusual transactions can help identify or limit the impact of these campaigns.