This banking trojan switches on a VPN so Google can't check its work

The opening move in ToxicPanda 2.0 is the clever bit. Before it installs the part that does the stealing, it shows a fake setup screen asking for permission to configure a VPN. Once you tap allow, it uses that permission to cut off traffic to Google Play and Google Play Services - the exact things that would have inspected and flagged whatever comes next. Only then does it unpack its payload and ask for Accessibility permissions.

Zimperium's zLabs team published the analysis last week. The first version of ToxicPanda went after a handful of banking apps. This one carries 167 remote commands and targets 349 banking, finance, e-wallet and cryptocurrency apps across 16 countries. It paints invisible layers over the real app to capture what you type, puts up a convincing fake lock screen to collect your PIN (a routine aimed at more than 140 apps), abuses Android's debug bridge for shell-level access to the phone, and hides its activity behind a bogus "system update" screen. There's even a command called autoBoot that gets around the aggressive battery-saving rules on Xiaomi, OPPO, Vivo, Samsung and Huawei handsets. The installers were being served out of Amazon AWS storage buckets.

None of this arrives through the Play Store. It arrives because somebody taps a link and sideloads an APK: a "new banking app," a parcel tracker, a free version of a paid game. So the defence is dull and it works. Install Android apps from the Play Store or your manufacturer's own store and nowhere else, and treat anything asking to set up a VPN or turn on Accessibility as a hard stop, because very little that's legitimate needs either, and almost nothing needs both.

Phones and PCs share the same accounts, which is where this touches your desktop. Tendvane's Privacy and accounts check goes over how you're signed in on Windows and what that account exposes, worth a look if you also bank from the big screen.