ToxicPanda Android Banking Trojan Expands to 349 Apps, Uses VPN Permissions to Block Google Play

ToxicPanda, an Android banking trojan, has reportedly evolved with expanded malicious functionality. According to a report from BleepingComputer, the malware now targets 349 applications and supports 167 remote commands — a significant expansion in both scope and capability compared to earlier versions. Notably, the malware is said to abuse Android VPN permissions to block access to Google Play, likely as a means of preventing victims from removing the malicious app or installing security tools.

Why It Matters

Banking trojans that broaden their targeted-app lists and remote-command surface become more dangerous with each iteration — more apps means more potential victims across different regions and financial institutions, and more remote commands typically translates to greater operator control over an infected device (overlay attacks, credential theft, SMS interception, and device manipulation are common capabilities in this malware family). The use of VPN permissions to interfere with Google Play access is a notable technique: it suggests attackers are actively working to entrench their access and frustrate remediation, rather than relying solely on initial infection tactics. Any organization with a mobile workforce or customers using Android banking/finance apps within the malware's targeting scope should treat this as a relevant threat.

What Defenders Should Watch For

• Unusual or unexpected VPN profile installations on managed or BYOD Android devices, particularly ones not tied to an approved corporate VPN solution.
• Devices where the Google Play Store becomes inaccessible or non-functional without a clear, expected cause — this could indicate deliberate interference by malware with VPN-level permissions.
• Sideloaded APKs or apps installed from outside the Google Play Store on corporate or BYOD devices, especially on devices used for banking or accessing sensitive apps.
• Mobile threat defense (MTD) or EMM/MDM telemetry showing accessibility-service abuse, excessive permission grants, or apps requesting VPN control shortly after installation.
• General hygiene: enforce install restrictions to trusted app stores only, monitor for anomalous permission requests on managed devices, and ensure users are aware of the risks of sideloading APKs from unofficial sources.

This is a developing story and the details here reflect a single public report rather than a full technical writeup or IOC set. Defenders monitoring mobile threats — particularly for financial services or organizations with Android banking app usage — should keep an eye on further reporting for indicators of compromise and expanded technical analysis. Read the original coverage at BleepingComputer.