The ToxicPanda 2.0 malware is issuing an account loot.

The ToxicPanda 2.0 malware is issuing robberies of Android users' accounts.

According to a report by the website Cyber Security News, the detection of the return of ToxicPanda malware in a new version under the name ToxicPanda 2.0 by a research team from Zimperium, a mobile security expert firm, the research team said that the new version of the malware has greatly upgraded its capabilities. The malware has expanded the number of applications that are the target of stealing money and data more than ever. The malware has the ability to steal PIN codes from 140 bank applications and Kerrency scripts, and has the ability to overlay the screen to steal access codes on institutional apps. Up to 349 apps in 16 countries around the world. Not only does this version of the malware support up to 167 Command commands, it can be called very versatile.

The research team reported that this malware epidemic will start by tricking the victim into installing a fake application that will act as a dropper. After it runs, the malware will bounce a screen with an interface similar to the official Android app store, Google Play, to install and request permissions related to the virtual private network (VPN or Virtual Private Network). After the installation, the fake app will immediately request permissions for a disabled user assistance or Accessibility Mode. This permissions will allow the malware to do so. Monitor the target application, secretly store data on the screen, trap printing (Keylogging), stack the screen, and allow hackers to remotely access the victim's machine (Remote Access). In addition, after installation, the malware compiles the list of applications, package names, and icons of those applications back to the control server (C2 or Command and Control) for use in the next step.

Then, when the victim gets a financial application job on the list of malware target applications, the malware contacts the C2 server to request a file to overlay the application screen in HTML file format to trap login data through a fake login page. In addition, the malware can also overlay a transparent screen over the bank application's input screen (Banking Keypad). Not only that, the malware can also use the screen overlay with a fake mobile unlock screen to trap the screen unlock code.

The malware has the ability to use commands to update the list of target applications and search queries (Keywords) used to capture PIN codes flexibly without installing a new malware latent application on the victim's machine. In addition, it also makes use of Accessibility Mode to enable Developer Mode or Developer Options to enable Wireless Debugging that gives malware and hackers the right to access the victim's machine at the highest level, or Shell with a pair of ADB Client matches on the victim's own machine through an IP number 127.0.0.1 called a shortcut. Absolutely complete control of the machine.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Toxicpanda2# freedomhack