Zimperium zLabs Uncovers ToxicPanda 2.0, a Significantly More Powerful Android Banking Trojan

News Highlights

• Malware expands targeting to 349 banking, financial, e-wallet, and cryptocurrency apps across 16 countries.
• New capabilities include automated ADB abuse, lock screen credential theft, and 167 remote commands. 
• Research highlights the growing sophistication of mobile banking malware and the need for on-device mobile threat protection.

DALLAS, Aug. 19, 2026 /PRNewswire/ -- Zimperium, the global leader in AI-empowered mobile security, today announced new research from its zLabs threat research team detailing the evolution of ToxicPanda 2.0, an advanced Android banking trojan that significantly expands both its technical capabilities and the scale of its fraud campaign.

The latest variant represents a new generation of the original ToxicPanda banking Trojan and introduces 167 remote commands, expanding credential theft from a handful of banking applications to 349 banking, financial, e-wallet, and cryptocurrency applications across 16 countries, and adding sophisticated techniques to compromise Android devices, harvest banking credentials, and maintain long-term persistence on infected devices.

As mobile app adoption continues to rapidly grow for use in banking services, enterprise applications, digital identities, and sensitive corporate data, increasingly sophisticated Android malware poses ever greater risks to both consumers and corporations.

"ToxicPanda 2.0 demonstrates how quickly mobile malware continues to evolve," said Nico Chiaraviglio, Chief Scientist at Zimperium zLabs. "Rather than simply stealing credentials, this malware automates device compromise, expands financial targeting on a global scale, and abuses legitimate Android features to gain control over infected devices. It reflects the increasing sophistication of modern mobile threats."

Zimperium's AI-empowered, on-device mobile security protects organizations against advanced threats like ToxicPanda by detecting malware, device compromise, phishing overlays, and malicious application behavior before attackers can steal credentials or gain control of the device.

The complete technical analysis, including indicators of compromise (IOCs), is available here.

About Zimperium
Zimperium is the world leader in AI-empowered mobile security. Purpose-built for mobile, Zimperium provides unparalleled protection for mobile applications and devices, leveraging the power of AI to deliver autonomous mobile security that counters evolving threats including mobile phishing (mishing), malware, app vulnerabilities, app tampering, device compromise, and even zero-day attacks. Cybercriminals have adopted a mobile-first attack strategy, targeting organizations' most vulnerable attack surface - the mobile apps and devices that your organization and customers depend upon.

Contact: [email protected]

SOURCE Zimperium