ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have uncovered significant enhancements to the ToxicPanda Android banking malware, also known as TgToxic. In a report published on August 20, 2026, Zimperium zLabs detailed that the updated version, dubbed ToxicPanda 2.0, now includes a set of 167 remote commands, allowing threat actors to execute a wide range of malicious actions on compromised devices. Additionally, the malware features a PIN harvesting workflow designed to intercept credentials from more than 140 banking and cryptocurrency applications, expanding its targeting footprint globally.

The report highlights that ToxicPanda 2.0 is being used in conjunction with another Android banking trojan, GoldDigger, which has also expanded its on-device fraud capabilities. These developments indicate a growing trend among cybercriminals to leverage on-device fraud techniques, which enable them to bypass traditional security measures and conduct unauthorized transactions directly from infected devices.

While the exact distribution methods were not detailed in the report, it is likely that the malware is spread through malicious apps or phishing campaigns. Once installed, the malware can execute remote commands, harvest PINs, and potentially intercept two-factor authentication codes, posing a significant risk to financial security.

The findings underscore the evolving sophistication of mobile banking malware and the need for heightened vigilance among Android users, particularly those who use banking and cryptocurrency apps.