--- title: ToxicPanda Android malware uses VPN permissions to block... description: ToxicPanda 2.0, an Android banking trojan, now requests VPN service permissions to block communication between infected devices and Google Play and Play... canonical: https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ToxicPanda Android malware uses VPN permissions to block Google Play | daily.dev og:description: ToxicPanda 2.0, an Android banking trojan, now requests VPN service permissions to block communication between infected devices and Google Play and Play... og:url: https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew og:image: https://api.daily.dev/og/posts/mYoGEdKEW.png og:image:alt: ToxicPanda Android malware uses VPN permissions to block Google Play og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ToxicPanda Android malware uses VPN permissions to block Google Play **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 2 upvotes · 1 comments ## Summary ToxicPanda 2.0, an Android banking trojan, now requests VPN service permissions to block communication between infected devices and Google Play and Play Services, disrupting app verification, updates, and Play Protect checks. The malware has expanded targeting to 349 banking, financial, crypto, and e-wallet apps across 16 countries and supports 167 remote commands. New capabilities include automated abuse of Wireless ADB to gain shell-level access by enabling Developer Options and Wireless Debugging via Accessibility Services, invisible phishing overlays, lock-screen spoofing to steal PINs and patterns, fake system update screens, and an 'autoBoot' command that bypasses OEM battery restrictions on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices. Zimperium reports it is distributed via AWS-hosted buckets and has published indicators of compromise on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does ToxicPanda 2.0 use VPN permissions to block Google Play? ToxicPanda 2.0 requests Android VPN service permissions to create a local network interface it controls, letting it block communications to Google Play and Google Play Services. This interferes with app verification, updates, and Play Protect checks. After blocking Google Play, it extracts and installs its payload, then requests Accessibility Service permissions. _Security teams tracking evolving Android malware tactics can follow updates like this on daily.dev._ ### How does ToxicPanda malware abuse Android Wireless ADB for shell access? Using Accessibility Services permission, ToxicPanda enables Developer Options and activates Wireless Debugging, then extracts the six-digit ADB pairing code and port to connect to the device's local ADB service. Once it gains shell permissions, it executes high-privilege commands through the ADB daemon, bypassing standard runtime consent prompts to grant itself broad permissions and enforce persistence. _Anyone defending Android fleets against ADB-abusing malware can track these techniques via daily.dev._ ### How many apps and remote commands does ToxicPanda 2.0 support? ToxicPanda 2.0 targets 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries and supports 167 remote commands. It also includes a separate PIN-harvesting module targeting 140 financial and cryptocurrency apps that can dynamically update its target list, and is distributed through Amazon AWS-hosted buckets. _Threat researchers scoping mobile banking trojan campaigns can follow scale metrics like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@akkitto** · 0 upvotes > That's why Google should stop restricting Android for open source creators so much. The restrictions only hurt them, while actual real criminals find ways of bypassing anyway... ## Similar posts on daily.dev - [New Rokarolla Android malware targets 217 banking, crypto apps](https://daily.dev/posts/new-rokarolla-android-malware-targets-217-banking-crypto-apps-w7sotfpil) · BleepingComputer · 0 upvotes · 0 comments - [A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds](https://daily.dev/posts/a-new-android-trojan-called-rokarolla-targets-217-banking-apps-and-can-steal-your-pin-sms-codes-an-sxasbjsfp) · The Next Web · 0 upvotes · 0 comments - [OverlayPhantom-android-banking-trojan-hiding In Plain Sight](https://daily.dev/posts/overlayphantom-android-banking-trojan-hiding-in-plain-sight-7msycee4d) · Cyble · 0 upvotes · 0 comments - [Indonesia Hit by Android Banking App-Cloning Campaign](https://daily.dev/posts/indonesia-hit-by-android-banking-app-cloning-campaign-qhfetvndq) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#android](https://daily.dev/tags/android), [#malware](https://daily.dev/tags/malware), [#android-development](https://daily.dev/tags/android-development) [View this post on daily.dev](https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ToxicPanda Android malware uses VPN permissions to block Google Play","url":"https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew"},"datePublished":"2026-08-23T20:17:04.536Z","dateModified":"2026-09-14T07:55:45.288Z","description":"ToxicPanda 2.0, an Android banking trojan, now requests VPN service permissions to block communication between infected devices and Google Play and Play...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22406e3a81397d480450005ea923e032?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22406e3a81397d480450005ea923e032?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,android,malware,android-development","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"ToxicPanda Android malware uses VPN permissions to block Google Play"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew","comment":[{"@type":"Comment","text":"That’s why Google should stop restricting Android for open source creators so much. The restrictions only hurt them, while actual real criminals find ways of bypassing anyway…","datePublished":"2026-08-23T22:23:36.729Z","url":"https://daily.dev/posts/mYoGEdKEW#c-4QovW8VBX","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play-myogedkew#faq","mainEntity":[{"@type":"Question","name":"How does ToxicPanda 2.0 use VPN permissions to block Google Play?","acceptedAnswer":{"@type":"Answer","text":"ToxicPanda 2.0 requests Android VPN service permissions to create a local network interface it controls, letting it block communications to Google Play and Google Play Services. This interferes with app verification, updates, and Play Protect checks. After blocking Google Play, it extracts and installs its payload, then requests Accessibility Service permissions. Security teams tracking evolving Android malware tactics can follow updates like this on daily.dev."}},{"@type":"Question","name":"How does ToxicPanda malware abuse Android Wireless ADB for shell access?","acceptedAnswer":{"@type":"Answer","text":"Using Accessibility Services permission, ToxicPanda enables Developer Options and activates Wireless Debugging, then extracts the six-digit ADB pairing code and port to connect to the device's local ADB service. Once it gains shell permissions, it executes high-privilege commands through the ADB daemon, bypassing standard runtime consent prompts to grant itself broad permissions and enforce persistence. Anyone defending Android fleets against ADB-abusing malware can track these techniques via daily.dev."}},{"@type":"Question","name":"How many apps and remote commands does ToxicPanda 2.0 support?","acceptedAnswer":{"@type":"Answer","text":"ToxicPanda 2.0 targets 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries and supports 167 remote commands. It also includes a separate PIN-harvesting module targeting 140 financial and cryptocurrency apps that can dynamically update its target list, and is distributed through Amazon AWS-hosted buckets. Threat researchers scoping mobile banking trojan campaigns can follow scale metrics like these on daily.dev."}}]} ```