Researchers describe an updated Android banking Trojan, ToxicPanda 2.0 (also tracked as TgToxic), which they say targets more than 140 banking and cryptocurrency applications. Zimperium zLabs reports the malware includes a PIN-harvesting workflow intended to capture credentials from infected devices.
The reports say the new variant adds substantial changes, including a large set of remote commands—described as 167—and broadens the malware’s targeting footprint globally. Infosecurity Magazine and The Hacker News both frame the update as an evolution of the existing ToxicPanda toolset, emphasizing operational enhancements and expanded victim interest in banking and crypto services. Both outlets attribute the technical findings to Zimperium’s research, and both focus on how the malware’s on-device fraud capabilities are being improved.
While the two sources differ mainly in emphasis—one highlighting the “updated” variant and the other detailing specific command and targeting expansion—they converge on the same core points: a refined ToxicPanda Android malware release and increased targeting of banking and crypto-related apps through credential and PIN collection.
