ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud ToxicPanda 2.0与GoldDigger通过设备端欺诈扩大Android银行攻击

TL;DR

• ToxicPanda 2.0 (TgToxic) introduces 167 remote commands, expanding its targeting from 16 to over 140 banking/crypto apps and 349 financial institutions across 16 countries
• The malware abuses Android accessibility services to harvest UI elements, deploy overlay-based credential theft, and automate Wireless Debugging (ADB) for privilege escalation and shell-level access
• GoldDigger, attributed to Chinese-speaking threat actor GoldFactory, uses a sophisticated "dpt-shell" packer with anti-analysis evasion techniques and impersonates airline/shopping apps to target South Africa and the U.K.
• Both malware families leverage WebSocket-based C2 channels, with ToxicPanda 2.0 shifting to AWS-hosted buckets for malware distribution
• GoldDigger can inject inputs into banking apps to mimic user interactions, initiate fraudulent transactions, and stream audio/video via RTMP to its C2 server

Why It Matters

The rapid evolution of Android banking trojans demonstrates how threat actors are increasingly leveraging cloud infrastructure and sophisticated evasion techniques to scale attacks globally. For security practitioners, these developments highlight the critical importance of monitoring accessibility service permissions and implementing robust mobile threat detection, as these malware families can achieve full device compromise with minimal user interaction.

Technical Details

• ToxicPanda 2.0: Connects to C2 via HTTPS-initiated bidirectional WebSocket; abuses Android accessibility services to steal all UI elements and enable Developer Options/Wireless Debugging automatically; deploys fake "system update" overlays and transparent PIN-capture overlays; overwrites device lock screen credentials with attacker-defined values; profiles OEM vendors to bypass battery optimization policies
• GoldDigger: Uses "dpt-shell" packer that encrypts native logic, detects and crashes Frida attachments, and prevents debugger attachment via PTRACE system call; injects synthetic input (text entry, clicks, gestures) into banking apps to execute fraudulent transactions; runs targeted apps in a virtual environment for real-time credential interception
• C2 Infrastructure: Both trojans use WebSocket for command reception; GoldDigger streams recorded audio/video via RTMP protocol; ToxicPanda 2.0 samples distributed through Amazon AWS-hosted buckets
• Target Expansion: ToxicPanda 2.0 targets 140+ banking/crypto apps and 349 financial institutions across 16 countries, compared to the previous version's 16 banking applications
• Distribution: GoldDigger impersonates airline companies and shopping retailers; both malware families rely on social engineering to trick users into granting accessibility services permissions

Industry Insight

• Organizations should enforce strict mobile device management (MDM) policies that audit and restrict accessibility service permissions, as these have become the primary attack vector for both malware families
• The shift toward cloud-hosted malware distribution (AWS buckets) indicates attackers are professionalizing their infrastructure; security teams should monitor for unusual cloud storage activity and implement egress filtering
• The increasing sophistication of anti-analysis techniques (Frida detection, PTRACE anti-debugging) suggests a growing arms race between mobile malware developers and security researchers, necessitating investment in dynamic analysis environments and behavioral detection rather than signature-based approaches

TL;DR

• ToxicPanda 2.0新增167个远程命令，攻击范围从16个银行应用扩展至140+银行及加密货币应用，覆盖16个国家349家金融机构
• 利用Android无障碍服务窃取全屏幕UI元素，通过无线调试(ADB)自动化实现权限提升和Shell级访问
• GoldDigger采用dpt-shell高级打包器实施反分析，可注入输入模拟用户操作发起欺诈交易，并支持实时屏幕共享和虚拟环境运行
• 攻击分发转向AWS云存储桶，结合系统更新覆盖层和透明覆盖层实现凭证窃取与行为隐蔽
• 攻击者通过设备管理员权限覆盖锁屏密码，利用无障碍服务绕过电池优化确保后台持续运行

为什么值得看

本文揭示了Android银行恶意软件在权限提升、反分析和分发基础设施方面的技术演进，为移动安全防御者提供了关键威胁情报。攻击者对无障碍服务的滥用和云基础设施的利用，标志着移动金融犯罪正朝着更自动化、更隐蔽的方向发展，对金融机构和移动应用开发者具有重要警示意义。

技术解析

ToxicPanda 2.0通过滥用Android无障碍服务实现全屏幕UI元素窃取，结合透明覆盖层捕获PIN码。其创新性地利用无障碍服务自动启用开发者选项并开启无线调试功能，通过ADB协议实现设备权限提升和Shell级访问。C2通信采用HTTPS初始请求建立双向WebSocket通道，支持167个远程命令的实时控制。

GoldDigger采用dpt-shell打包器对代码和资源进行多层混淆，实现加密原生逻辑、检测Frida附加并崩溃进程、通过PTRACE系统调用阻止外部调试器附着等反分析技术。攻击者可通过无障碍服务注入文本输入、按钮点击和手势操作，模拟真实用户行为发起欺诈交易。

两者均利用虚假"系统更新"覆盖层掩盖后台活动，通过WebSocket接收C2指令执行屏幕录制、音频视频采集(RTMP协议)、联系人/SMS收集等操作。分发方式转向AWS托管存储桶，体现攻击基础设施的云化趋势。

行业启示

移动银行恶意软件正加速向自动化权限提升和云化分发演进，安全厂商需加强无障碍服务滥用检测和动态行为分析能力。金融机构应强制要求应用最小权限原则，对涉及金融操作的应用实施严格的无障碍服务访问控制。

攻击者利用云基础设施和高级反分析技术表明，传统静态检测已不足以应对现代移动威胁。建议建立基于机器学习的行为分析平台，实时监控设备管理员权限申请、无线调试启用等异常行为模式。

针对特定地区的定向攻击（南非、英国）提示企业需加强区域化威胁情报共享，开发针对本地化攻击手法的检测规则。用户教育应聚焦于识别虚假应用商店和权限滥用行为，建立多层防御体系。