How to Protect Android Apps Against ToxicPanda Malware
Learn how to detect and protect against ToxicPanda Android malware using Appdome’s no-code unified mobile app defense platform.
What is ToxicPanda Malware?
ToxicPanda is an Android banking trojan identified in late 2024, primarily targeting users in Europe, Latin America, and Asia. Disguised as legitimate applications such as Google Chrome and popular banking apps, it spreads through malicious APK files, often distributed via counterfeit app store pages. Once installed, ToxicPanda exploits Android’s accessibility services to gain elevated permissions, enabling it to perform On-Device Fraud (ODF) by remotely controlling the infected device. This method allows attackers to bypass traditional security measures, such as behavioral detection systems and multi-factor authentication (MFA), without using techniques like Automatic Transfer Systems (ATS) or overlay attacks. ToxicPanda intercepts one-time passwords (OTPs) sent via SMS or authenticator apps and records user inputs to harvest sensitive information, such as banking credentials and personal data. Believed to be developed by a Chinese-speaking threat actor, it shares similarities with the TgToxic malware family, which is known for targeting crypto wallets. As of November 2024, over 1,500 devices have been compromised, with significant infection rates reported in Italy (56.8%), Portugal (18.7%), Hong Kong (4.6%), Spain (3.9%), and Peru (3.4%).
How Does Appdome Protect Against ToxicPanda?
Taking all the above into consideration, you can use Appdome to protect against ToxicPanda using a combination of the following protection methods:
- RASP & App Shielding – Prevents ToxicPanda from injecting itself into installed apps and repackaging them. Also includes anti-tampering, anti-debugging, anti-emulator, and other protections against dynamic attacks at runtime.
- Code Obfuscation – Protects against decompiling and malicious reverse engineering which hackers use to read and understand source code.
- Root Detection – Protects mobile apps from running on rooted devices, which exposes apps to tampering, data theft, and malware by giving attackers elevated access to system files and app data.
- MitM Attack Prevention – Prevents ToxicPanda from intercepting or hijacking sessions to harvest or steal data.
- Keylogging Prevention – Prevents the use of malicious keyloggers which may be used to intercept two-factor authentication codes or harvest sensitive information.
- Prevent Accessibility Services Malware – Prevents malicious actions taken by malware that exploit Android’s AccessibilityService, which when abused can be used to intercept sensitive inputs like passwords and 2FA codes, take screenshots, and simulate user actions such as taps and swipes.
- Prevent Remote Desktop Exploits – Detects 3rd party apps that attempt to remotely control the protected app, typically via social engineering or tricking the user.
- Google Play Store Signature Validation – protects against fake apps, clones, masquerading, which malware often do to trick users into performing harmful actions.
Each of the protections above is linked to the relevant knowledge base article for that feature, which provides detailed information about each feature and explains how to implement the protection in your Android app.
Prerequisites
To use Appdome’s to protect Android apps against ToxicPanda, you’ll need the following:
- Appdome account (create a free Appdome account here)
- A license for the relevant features mentioned above.
- Mobile App (.apk or .aab for Android)
- Signing Credentials (see Signing Secure Android apps).
Related Articles:
- How to Protect Android Apps Against BrasDex Malware
- How to Protect Android Apps Against Xenomorph Malware
- How to Protect Android Apps Against CraxsRAT Malware
- How to Protect Android Apps Against FjordPhantom Malware
- How to Protect Android Apps Against Octo
- How to Protect Android Apps Against Panda Malware
- How to Protect Android Apps Against Brokewell Malware
- How to Protect Android Apps Against Hiddad Malware
If you have any questions, please send them our way at support.appdome.com or via the chat window on the Appdome platform.
Thank you!
Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project.
