Android Banking Trojans ToxicPanda 2.0 and GoldDigger Expand Global Financial Institution Attacks
Advanced Android banking Trojans, ToxicPanda 2.0 (also known as TgToxic) and GoldDigger, are significantly expanding their targeting scope and capabilities, posing increased threats to financial services. ToxicPanda 2.0, active since July 2022, now targets 349 financial institutions across 16 countries, a substantial increase from its previous version which targeted only 16 banking applications. This updated malware leverages Android accessibility services to steal UI elements, implement overlay-based credential theft, and harvest PINs from over 140 banking and cryptocurrency applications. It also uses automated click mechanisms to abuse Android Wireless Debugging for privilege escalation and shell-level access. GoldDigger, attributed to the Chinese-speaking threat actor GoldFactory, is capable of on-device fraud, impersonating airline companies and shopping retailers, particularly in South Africa and the U.K. It can inject input into banking apps to mimic user interaction, initiate fraudulent transactions... 
