Dangerous Android banking malware attempts to deceive victims with fake money transfers

• ToxicPanda can initiate money transfers and even retrieve MFA codes
• The banking Trojan targets consumers in Europe and Latin America
• More than 1,500 devices already compromised

A Chinese hacker is targeting Android devices in Europe and Latin America with a banking Trojan capable of stealing money from victims’ accounts.

According to a new report from cybersecurity researcher Cleafy, the ToxicPanda Trojan is similar to an older, well-known malware called TgToxic, which was first discovered in 2023. The two share some similarities, although ToxicPanda can be described as “lite”. version, as many features appear to have been slimmed down and some have been left as simple placeholders.