Wednesday , November 6 2024
Icon
Identified ToxicPanda’s icons: Cleafy

“ToxicPanda” banking trojan from Asia hit Europe and LATAM

In late October 2024, Cleafy’s Threat Intelligence team noticed a surge in a new Android malware known as TgToxic. However, deeper analysis showed that, despite some similarities to TgToxic commands, the code is quite different. Many typical TgToxic features are missing, and some commands are just placeholders. Consequently, the team have started tracking this malware as ToxicPanda.

ToxicPanda is part of the new generation of mobile malware, enabling hackers to take over accounts directly from infected devices using the On Device Fraud technique. This method has also been utilized by banking trojans like Medusa, Copybara, and BingoMod. A manual approach to this malware has benefits: it needs less skilled developers, allows targeting any banking customers, and can evade many detection measures used by banks and financial services.

“ToxicPanda” banking trojan from Asia hit Europe and LATAM

In late October 2024, Cleafy’s Threat Intelligence team noticed a surge in a new Android malware known as TgToxic. However,...
Read More
“ToxicPanda” banking trojan from Asia hit Europe and LATAM

(CVE–2023-46747)
Hacker exploit Critical F5 BIG -IP Vulnerability in Bangladesh: CIRT report

Cyber Threat Intelligence Unit of BGD e-GOV CIRT found evidence of compromise linked to the vulnerability in F5 BIG-IP systems...
Read More
(CVE–2023-46747)  Hacker exploit Critical F5 BIG -IP Vulnerability in Bangladesh: CIRT report

APT36 to attack Windows Systems Absuing Google Drive & Slack

ElizaRAT is malware that mainly targets Windows systems and acts as a remote access tool (RAT), allowing attackers to access...
Read More
APT36 to attack Windows Systems Absuing Google Drive & Slack

Google fixes two Android zero-days: Demand Immediate Patching

In its November 2024 security update, Google fixed 40 vulnerabilities in Android, including two that are actively exploited: CVE-2024-43047 and...
Read More
Google fixes two Android zero-days: Demand Immediate Patching

GitHub launched an AI tool to build apps without code

GitHub has launched an AI tool called 'Spark' that allows users to create apps using natural language, eliminating the need...
Read More
GitHub launched an AI tool to build apps without code

Hacker offer Titas gas root access to sale

"A threat actor has reportedly claimed to gain root-level access to Titas Gas’s firewall server and is actively offering this...
Read More
Hacker offer Titas gas root access to sale

New malware FakeCall intercepts your calls to the bank

Zimperium researchers have found a new version of FakeCall malware for Android that threatens financial security. This malware redirects users'...
Read More
New malware FakeCall intercepts your calls to the bank

Hikvision Patches Security Flaw in Network Cameras

Hikvision, a top provider of network cameras, has issued firmware updates to fix a security vulnerability that could reveal users'...
Read More
Hikvision Patches Security Flaw in Network Cameras

SonicWall report
Government Sector faces 236% Surge in Malware Attacks

Global threat actors have significantly increased attacks on government sectors, with malware-driven attempts rising by triple digits in the first...
Read More
SonicWall report  Government Sector faces 236% Surge in Malware Attacks

Bangladesh Kubernetes User Group Meetup successfully completed

Meetup of Bangladesh Kubernetes User Group was held at Banani Club 9294, Dhaka on Thursday, 31 October 2024. A lively...
Read More
Bangladesh Kubernetes User Group Meetup successfully completed

Cleafy’s Threat Intelligence team found that the attackers behind ToxicPanda are Chinese speakers. It’s unusual for them to focus on banking fraud in Europe and LATAM, suggesting a possible shift in their operational targets.

Further analysis of the ToxicPanda botnet infrastructure granted our team access to comprehensive telemetry data, revealing the full extent of this campaign:

Over 1500 Android devices were infected and remotely controlled during the ToxicPanda fraud campaign. Italy is the primary hotspot, accounting for more than 50% of the infected devices, followed by Portugal, Spain, France, and Perù.

This geographical distribution underscores the ToxicPanda botnet’s significant reach and adaptability. These numbers suggest that the operators are expanding their focus beyond primary European targets, hinting at a potential shift towards Latin America.

The Cleafy team notes, “While it shares some bot command similarities with the TgToxic family, the code diverges considerably from its original source”. This divergence led to the malware being reclassified as ToxicPanda.

Cleafy’s Threat Intelligence team analysts identified the following icons during this investigation. It is evident that TA employs a mix of well-known brands (e.g., Google Chrome, VISA) and decoy icons resembling dating apps to enhance the malware’s deceptive capabilities and broaden its reach.

This malware is a modern remote access tool (RAT) that lets attackers conduct On-Device Fraud (ODF) on compromised Android devices. By operating directly on the device, attackers can avoid detection by security systems used by banks and financial institutions.

ToxicPanda leverages several advanced features that make it highly effective in banking fraud:

Accessibility Service Abuse:
By using Android’s accessibility services, ToxicPanda can gain higher permissions, alter user inputs, and collect data from banking apps, making it especially effective at compromising financial transactions.

Remote Control and Real-Time Fraud:
ToxicPanda allows attackers to remotely control infected devices, enabling them to initiate transactions, change account settings, and intercept OTPs to bypass two-factor authentication.

Obfuscation Techniques:
To avoid detection, the malware employs various obfuscation techniques, using “code-hiding techniques to make it difficult for security researchers to analyse the malware.”

Unique Botnet Structure and C2 Communication:
ToxicPanda’s botnet uses three hardcoded domains to connect with its command and control (C2) server. This setup streamlines initial connections and allows for controlled remote configuration.

Check Also

Hacker

Bangladeshi hacker hack for girlfriend’s expenses; finally caught

Fazle Hassan Anik hacked girls’ Facebook accounts to steal sensitive pictures, which he used to …

Leave a Reply

Your email address will not be published. Required fields are marked *