Android Malware Hijacks VPN to Silence Google Play

The ToxicPanda Android malware has evolved, adding new capabilities that let it intercept network traffic and block communication with Google Play. The updated version, detailed by mobile security firm Zimperium, now targets 349 applications and supports 167 remote commands, a significant expansion from earlier versions.

VPN Permissions for Control

ToxicPanda 2.0 requests VPN service permissions to create a local interface, giving it control over network traffic passing through the device. This network-level control allows the malware to interfere with security checks and actions, including app verifications, updates, and Play Protect communication. By blocking Google Play, the malware can prevent the installation of security patches and the detection of malicious activity.

Distribution and Delivery

According to Zimperium, ToxicPanda 2.0 is distributed through Amazon AWS-hosted buckets. The malware first obtains VPN permissions, then blocks Google Play communications, extracts and installs its payload, and requests Accessibility Service permissions to proceed with its malicious activities.

Expanded Targeting

The latest version supports 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries. It also includes a separate PIN-harvesting module targeting 140 financial and cryptocurrency apps, which can dynamically update its target list. The overlays are invisible to victims, allowing the malware to capture touch inputs on targeted apps. Additionally, ToxicPanda spoofs the Android lock screen to steal device PINs, patterns, and passwords. Some samples also use fake system update screens to hide ongoing malicious activity.

Persistence Through AutoBoot

One command, 'autoBoot,' identifies the host device manufacturer and launches the corresponding OEM-specific auto-start or power management settings to maintain persistence. Zimperium reports that this bypasses battery consumption protections that kill background processes on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices.

Abusing ADB

The most notable feature in the recent ToxicPanda version is its automatic abuse of the Android Debug Bridge (ADB) to gain shell access. ADB is a command-line tool for executing shell commands on Android devices, and Wireless ADB, introduced in Android 11, provides this access over Wi-Fi without a USB connection. Using Accessibility Services permission, the malware enables Developer Options, activates Wireless Debugging, extracts the six-digit ADB pairing code and port, and connects with the device's local ADB service.

“Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB daemon, the malware bypasses standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence.”

— Zimperium

Growing Trend

Wireless ADB abuse is a growing trend among Android malware, as other malware authors have implemented it in their tools. Recently, Group-IB reported a similar mechanism in the latest version of the RedHook malware. Zimperium has published a list of indicators of compromise (IoCs) associated with the latest ToxicPanda version in a GitHub repository.

• 167 remote commands supported by ToxicPanda 2.0
• 349 apps targeted by phishing overlays
• 140 financial and crypto apps targeted by PIN-harvesting module
• 16 countries affected

Implications for Users

This development highlights the increasing sophistication of mobile malware. The ability to block Google Play communications before installing a payload means that malware could operate without triggering the usual warnings, potentially leaving users unaware their device is compromised. The automated ADB abuse grants shell-level access without user interaction, allowing attackers to steal credentials and manipulate devices in ways that are hard to detect. As more malware adopts these techniques, Android users should be cautious about the apps they install and the permissions they grant.