Dangerous Android banking malware looks to trick victims with fake money transfers

• ToxicPanda can initiate money transfers and even grab MFA codes
• The banking trojan is targeting consumers in Europe and Latin America
• More than 1,500 devices already compromised

A Chinese hacker is targeting Android devices in Europe and Latin America with a banking trojan able to steal money from victim’s accounts.

A new report from cybersecurity researchers Cleafy says the trojan, ToxicPanda, is quite similar to a piece of older, known malware called TgToxic, which was first spotted in 2023. The two have some similarities, although ToxicPanda can be described as a “lite” version, since many features seem to be stripped down, and some were left as simple placeholders.