ToxicPanda, an Android malware family focused on financial targets, has added a set of capabilities that can interfere with Google Play and Google Play Services communications, according to BleepingComputer’s report on research from mobile security company Zimperium. The most direct change is network-level control. BleepingComputer reports that ToxicPanda 2.0 asks for Android VPN service permissions, then creates a local interface that lets the malware control traffic flowing through it. With that position on the device, it can block communications from Google Play and Google Play Services, including activity tied to app verification, updates, Play Protect communication, and other actions intended to protect users. The sequence matters. According to the report, ToxicPanda 2.0 obtains VPN service permissions, blocks Google Play communications, extracts and installs its payload, and then asks for Accessibility Service permissions. That chains together two Android features that are legitimate in normal contexts but powerful when granted to malware: one affects traffic, while the other can automate on-device actions and observe user interaction. Zimperium says the malware is being distributed through Amazon AWS-hosted buckets, BleepingComputer reports. The latest version is said to support 167 remote commands and phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries. A separate PIN-harvesting module reportedly targets 140 financial and cryptocurrency apps and can update its target list dynamically. The credential-capture mechanics go beyond ordinary login overlays. BleepingComputer reports that Zimperium found app overlays that are invisible to victims while capturing touch inputs on targeted apps. ToxicPanda also spoofs the Android lock screen to collect device PINs, unlocking patterns, and passwords, while some analyzed samples used fake system update screens to mask malicious activity running in the background. A second major capability is abuse of Android Debug Bridge, or ADB, the command-line tool used to execute shell commands on Android devices. Wireless ADB, introduced in Android 11, enables that access over Wi-Fi rather than over a USB cable. According to the report, ToxicPanda uses Accessibility Services to enable Developer Options, activate Wireless Debugging, extract the six-digit ADB pairing code and port, and connect to the device’s local ADB service. That gives the malware a route to shell-level access on the infected device. BleepingComputer cites Zimperium as saying that, once ToxicPanda reaches shell user permissions, it can execute higher-privilege commands through the ADB daemon, bypass standard Android runtime consent prompts, grant itself broad permissions, weaken operating-system background restrictions, enable key components silently, and preserve persistence. The malware also includes an `autoBoot` command designed to improve persistence across different Android manufacturers. BleepingComputer reports that the command identifies the device maker and opens the relevant original equipment manufacturer auto-start or power-management settings. Zimperium says this is used to bypass battery-consumption protections that would otherwise kill background processes on Xiaomi, OPPO, Vivo, Samsung, and Huawei devices. The report frames Wireless ADB abuse as a growing pattern among Android malware, noting that other malicious tools have implemented similar mechanisms and that Group-IB recently reported a comparable approach. Within this cluster, however, the core evidence is Zimperium’s analysis as reported by BleepingComputer, so the precise prevalence and active campaign scale remain single-source details. Who benefits: The operators of ToxicPanda benefit from broader targeting and more reliable persistence on infected devices. Defenders benefit from a clearer map of the permission chain and device features being abused. Who's exposed: The report describes phishing overlays for 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries, plus a separate PIN-harvesting module targeting 140 financial and cryptocurrency apps. Devices from Xiaomi, OPPO, Vivo, Samsung, and Huawei are specifically named in connection with the malware’s attempts to bypass background-process restrictions.