Android Banking Trojans Gain On-Device Fraud Tools

Android banking trojans are evolving beyond simple credential phishing, with new variants now capable of automating fraudulent transactions directly on infected devices. Security researchers have detailed significant upgrades to two prominent families, ToxicPanda and GoldDigger, which are expanding their reach and adding sophisticated evasion and attack techniques.

The findings, reported by Zimperium zLabs and IBM Trusteer, highlight a growing trend where mobile malware mimics user interactions to initiate fraud from within legitimate banking apps, bypassing traditional security measures like two-factor authentication.

Expanding Global Footprint

Zimperium zLabs, in a Wednesday report, detailed an updated version of ToxicPanda (aka TgToxic) that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. The malware, known to be active since at least July 2022, now targets more than 140 banking and cryptocurrency applications with a PIN harvesting workflow.

This marks a dramatic expansion from the previous version, which focused on just 16 banking apps. The new iteration casts a much wider net, reflecting a strategic shift in the threat actors' approach.

Accessibility Service Abuse

ToxicPanda 2.0 continues to exploit the Android accessibility service, a common vector for banking trojans. "By abusing the Android accessibility service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions [across 16 countries], compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities," security researcher Vishnu Pratapagiri said.

The malware uses fake overlays to capture credentials and lock screen PINs, while also deploying transparent overlays to invisibly intercept touch input.

Wielding Wireless Debugging

One of the most notable new capabilities is the abuse of Android's Wireless Debugging feature, typically used by developers for testing. ToxicPanda 2.0 uses automated clicks to enable Developer Options and turn on Wireless debugging, then connects via Android Debug Bridge (ADB) to gain shell-level access. This allows privilege escalation and a deeper level of control over the compromised device.

"By abusing the Android accessibility service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions [across 16 countries], compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities,"

— Vishnu Pratapagiri, security researcher at Zimperium

Concealment and Persistence

The updated malware also borrows tricks from other recent families, displaying full-screen "system update" overlays to hide its actions, similar to the newly-discovered Manic. It can overwrite the device's local lock screen PIN with an attacker-defined value and bait victims into granting Device Administrator privileges.

To ensure persistence, ToxicPanda 2.0 profiles the device's OEM vendor and uses accessibility services to exempt itself from battery optimization policies, allowing uninterrupted background operation.

Cloud-Based Distribution

Distribution methods are also evolving. "The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery," Zimperium said.

This move to cloud storage suggests a more scalable and adaptable infrastructure for spreading the malware.

GoldDigger's Sophisticated Packer

The GoldDigger trojan, first documented by Group-IB in October 2023, is also making headlines. Attributed to GoldFactory, a Chinese-speaking threat actor linked to other banking malware families like GoldPickaxe, GoldDiggerPlus, and GoldKefu, GoldDigger is now being deployed in campaigns targeting South Africa and the U.K.

According to IBM Trusteer, GoldDigger uses a sophisticated packer called "dpt-shell" to obfuscate its code and resist analysis. The packer encrypts native logic, detects and crashes when Frida (a dynamic instrumentation tool) is attached, and prevents external debuggers by marking itself as traced via the PTRACE system call.

Fake Apps and On-Device Fraud

The current GoldDigger campaign impersonates airline companies and shopping retailers, leading to a "massive infection" in South Africa and the U.K. Victims are tricked into installing malicious apps and granting accessibility permissions, which the malware then abuses for fraudulent actions.

"GoldDigger can inject input to the banking app to mimic user interaction, such as entering text, clicking buttons, and performing gestures," security researcher Shahar Tavor Lusky said. This allows the malware to initiate fraudulent transactions from the victim's banking app to the attacker, a tactic known as on-device fraud (ODF).

Real-Time Screen Access and Data Theft

GoldDigger also provides the operator real-time access to the victim's screen, captures credentials via fake overlays, and can run a targeted app within a virtual environment to intercept sensitive data. For command-and-control (C2), it establishes a WebSocket connection to receive commands that can request accessibility and location permissions, capture input from any app, collect contacts and SMS messages, record audio and video, stream video to the C2 server via RTMP, open specific URLs, and launch specific apps like Google Play Store and Settings.

Protecting Against the Threat

To mitigate these threats, it's advised to review installed applications and remove any unfamiliar or suspicious ones, audit app permissions before granting them, download apps only from trusted sources and developers, keep devices up-to-date, enable two-factor authentication (2FA) for all online accounts, and monitor bank accounts for unusual transactions.

Why This Matters

The evolution of these trojans underscores a significant leap in mobile malware sophistication. On-device fraud represents a direct challenge to bank security systems, as transactions originate from the legitimate app on a legitimate device, making them harder to flag as fraudulent. For users, this means that even with strong banking app security, a compromised device could allow attackers to drain accounts without needing to steal passwords. Staying vigilant about app installations and permissions is no longer just good practice; it is a critical defense against a growing and increasingly automated threat.