Malware

ToxicPanda

ToxicPanda is an Android banking RAT first identified by Cleafy in October 2024. It shows similarity to the TgToxic campaign, but appears to be a new development rather than a derivative. The threat actors are likely Chinese speakers. ToxicPanda initially made use of hardcoded C2 domains only, but started to incorporate a DGA in late 2024.

MITRE ATT&CK TTPs 8

T1027
Obfuscated Files or Information
Defense Evasion
 T1056.002
GUI Input Capture
Collection
 T1059
Command and Scripting Interpreter
Execution
 T1078
Valid Accounts
Defense Evasion
 T1136
Create Account
Persistence
 T1212
Exploitation for Credential Access
Credential Access
 T1497
Virtualization/Sandbox Evasion
Defense Evasion
 T1497.001
System Checks
Defense Evasion

Source Articles

New RatHat Android malware uses AI to automate device control
A new Android malware named RatHat has been identified by Zimperium zLabs, which leverages AI to automate remote device navigation and control. The malware is distributed via malvertising, SMS, and phishing sites that prompt users to download malicious APKs outside Google Play. It abuses Android Accessibility permissions and enables Developer Options and Wireless Debugging to establish persistent ADB-level access through a Go-based agent. The malware includes credential harvesting, SMS interception, and lock-screen bypass capabilities, and uses AI to dynamically interpret the device interface for real-time remote control. Anti-analysis techniques and persistence mechanisms make it resilient to removal and detection.
bleeping-computer ·14h ago