ToxicPanda 2.0: The Android Malware That Fakes a VPN

Every legitimate VPN app on Android shows you the same system prompt the first time it connects: "Connection request: [app] wants to set up a VPN connection that allows it to monitor network traffic." Most people tap OK without a second thought. In August 2026, researchers at Zimperium documented a new version of a banking trojan, ToxicPanda 2.0, that depends on people doing exactly that. It doesn't use the VPN permission to protect your traffic. It uses it to cut your phone off from Google's own malware scanner. Here's how the attack works and the simple checks that keep it off your phone.

What ToxicPanda 2.0 Is

ToxicPanda has been active since late 2023 as an Android banking trojan built for "on-device fraud," meaning it moves money from your accounts using your own phone, so the bank sees a trusted device. Version 2.0 is a big upgrade:

• Targets 349 banking, finance, crypto, and e-wallet apps across 16 countries
• Supports 167 remote commands for controlling the infected phone
• Combines fake banking login screens, remote access, PIN capture, and Accessibility abuse
• Attempts to automate Wireless Debugging for shell-level control
• Spreads by sideloading, with recent samples hosted in Amazon AWS storage buckets

The Attack Chain, Step by Step

1. The lure. You're persuaded to install an APK from outside Google Play, often presented as an update, a utility, or a "required" app.
2. A fake setup flow. The dropper shows convincing installation screens.
3. The VPN request. It asks for VPN permission. Once you grant it, it creates a local VPN interface on your phone.
4. Blinding Play Protect. It routes traffic through that interface and blocks Google Play and Google Play Services communications, so Play Protect can't scan or update.
5. The payload. With Google's defences silenced, it decrypts its hidden banking module and asks for Accessibility access, which lets it read your screen, tap buttons, and draw fake login pages over real banking apps.

Why Malware Wants the VPN Permission

Android's VPN permission (technically VpnService) lets an app route all of the device's network traffic through itself. That's exactly what a real VPN needs: it takes your traffic, encrypts it, and sends it to a server. In the wrong hands, the same power lets an app see, block, or redirect your traffic. ToxicPanda doesn't even need a remote server. It just uses the local tunnel as a filter that quietly drops Google's security traffic.

That's why the system dialog says "monitor network traffic." It isn't scare wording. It describes what the permission can do, which is why which VPN you trust matters so much.

Real VPN vs. Malicious VPN Request

The single best rule: if an app that isn't a VPN asks to set up a VPN, deny it.

Signs Your Phone Is Infected

• A key icon in the status bar when you haven't started a VPN
• Google Play won't load or update, or Play Protect hasn't run a scan in a long time
• An unfamiliar app listed under Settings › Accessibility
• Banking apps behaving strangely: extra login screens, OTP requests you didn't trigger
• Wireless Debugging enabled in Developer options when you never turned it on

How to Remove It

1. Go offline: turn on airplane mode to cut the attacker's remote access.
2. Check Settings › Network › VPN (the exact path varies by phone) and remove any VPN profile you don't recognise.
3. Revoke Accessibility and Device Admin from any unfamiliar app, then uninstall it. If it won't uninstall, boot into Safe Mode first.
4. Turn off Wireless Debugging and Developer options.
5. Call your bank from a different device, and change your banking and email passwords from that device too.
6. If you're in any doubt, back up your photos and do a factory reset.

Frequently Asked Questions

Related Articles