Researchers report two Android banking malware families (ToxicPanda 2.0 and GoldDigger) that rely on tricking people into installing malicious apps and granting powerful permissions. GoldDigger campaigns impersonate airlines and shopping retailers and then abuse Android Accessibility to take over banking apps and initiate fraudulent transfers from the victim’s device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You install a “special offer” airline app… and ten minutes later, money is moving out of your banking app by itself. That’s GoldDigger and ToxicPanda 2.0, Android banking malware hiding in fake airline and shopping apps, often hosted on Amazon AWS buckets. After install, they pop up a friendly message: “To work properly, please enable Accessibility services.” Here’s the nasty part: once you tap Allow, they abuse Accessibility to mimic your taps inside banking apps, use overlays to steal your PIN, and even throw up a full-screen fake “System update in progress” to hide what’s really happening. Your move: if any airline or shopping app asks for Accessibility or Device Administrator, stop right there and deny it, no exception.
Researchers say the Gigabud banking trojan is being installed via fake apps (e.g., pretending to be an airline, tax office, or government portal) and then uses an Android “work profile” to hide a tampered banking app. Victims are tricked into granting powerful permissions, after which attackers can…
Researchers linked the Iran-aligned Handala Hack persona to a Telegram-controlled backdoor (HEAVYGRAM) that can steal passwords and exfiltrate chat data. The campaign reportedly starts with social engineering on messaging apps (Telegram, WhatsApp, Instagram), where the attacker pretends to offer…
Researchers described an Android Trojan (“RatHat”) that starts with scam texts or malicious ads and tricks people into installing a fake app from a bogus download page. After installation, it pressures victims to grant Accessibility permissions using fake excuses or incentives, then uses those…
Researchers say the Android banking Trojan “Gigabud” can trick victims into installing a fake app, then create a separate Android work profile and run a cloned banking app inside it. Attackers can perform fraudulent transactions from that cloned app, which may reduce the chance that bank defenses…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Zimperium reports ToxicPanda 2.0 is a mobile banking trojan that targets 349 financial apps across 16 countries by impersonating legitimate screens and prompts to trick users into granting permissions. After installation, it uses Android Accessibility and Wireless Debugging to gain deeper control…
