Cyber criminals again targeted smartphone owners in Poland. Cybersecurity experts strike an alarm over the return of highly dangerous malware, which can take full control of the phone, bargain login data into mobile banking and consequently empty the victim's account. We're talking about a virus known as ToxicPandathat impersonates popular apps and strategy updates to infect Android devices. The threat is real and affects hundreds of thousands of Poles, especially users of popular telephone models. The infection is hard to detect and even harder to remove, as malware actively blocks standard deinstalling methods. cognition of his actions and methods of protection is crucial to not losing life savings.
What is ToxicPanda and why is it so dangerous?
ToxicPanda is an advanced bank trojan that was first identified by safety analysts in 2022. After a period of little activity, in fresh months he has returned with double strength, and its mark has become users in Europe, including Poland. Its main task is theft of bank application authentication data and intercepting one-time authorization codes, which opens up a consecutive way to the victim's money to cyber criminals.
The danger of this malware lies in its sophisticated mechanics of operation. Unlike simpler viruses, ToxicPanda is not limited to displaying ads or slowing down your phone. After the device is infected, it aims to get permissions for so-called. Accessibility Services Android. These are advanced permissions that let applications to simulate user actions, read screen content and take control of the interface. In the hands of cyber criminals, this becomes a powerful tool for avoiding security, including even double-step verification.
The consequences of infection can be catastrophic. Victims may lose not only their current bank accounts, but besides become the mark of identity theft. Criminals, having access to individual data, may borrow or commit another fraud on behalf of the victim. That is why it is so crucial to realize how infection occurs and how to defend itself from it.
How does the virus work? Learn the mechanics of attack step by step
The attack script utilizing ToxicPanda is usually carefully planned. Criminals usage sociotech to get the user to install malware on his own. Most commonly the virus spreads through false websitesthat match to delusion the authoritative sites of known companies or services. The user can visit specified a website via a prepared link in SMS, email or advertising on social media.
On a fake page, the victim is informed about the request to download an urgent update, for example for the browser Google Chrome or another popular application. The downloadable APK file is actually a carrier of the Trojan ToxicPanda. After installation, the application asks to be granted wide privileges, including key access rights. Many users, accustomed to accepting consent, unwittingly give criminals full control of the device.
When ToxicPanda obtains the essential permissions, it may:
- Take full control of your smartphone, simulating screen contact and text input.
- Record everything you kind on the keyboard (so-called keylogging), including logins, passwords and credit card numbers.
- Display false login screens (caps) on real banking applications to intercept data.
- Capture incoming SMS messages, including one-off authorisation codes from banks, effectively bypassing two-step verification.
- Hide your presence and block installation attempts.
The data collected in this way is immediately sent to servers controlled by criminals who can log into the victim's bank account and bargain funds.
Which phones are the most vulnerable? Check if you are in a hazard group
Analysis of cybersecurity experts indicates that the creators of ToxicPanda focus their attacks on circumstantial device groups. This is not a coincidence. They're aiming at The most popular and frequently cheaper series of smartphoneswhich have a immense user base. The more people usage a given model, the greater the chance of a massive attack.
The high-risk group primarily includes the owners of smartphones from the following series:
- Samsung Galaxy A (e.g. A52, A32, A13)
- Xiaomi Redmi (e.g. Redmi Note 11, Redmi 9, Redmi 10)
- Oppo A (e.g. Oppo A16, Oppo A54)
Having a telephone from 1 of these series does not automatically mean that the device is infected. However, this shows that its users should hold special vigilance. The popularity of these models makes criminals frequently optimize their malicious software just in terms of their software and specifications, which increases the effectiveness of the attack. delight note that the virus can possibly infect any Android telephone if you do not follow the basic safety rules.
How to remove ToxicPanda? It's harder than you think.
One of the biggest challenges associated with ToxicPanda is to remove it. The Trojan was designed to actively defend itself from uninstalling. After obtaining the privileges of the device admin or access to the convenience function, it blocks the ability to enter the application settings and usage the option “Uninstall”. Attempts to disable the powers granted to him besides fail.
Standard methods, specified as scanning your telephone with an antivirus program, may not be adequate if the virus has deep-seated into the system. In specified a situation, the only effective but method solution is Manually delete the application with your computer and Android Debug Bridge (ADB) tool. This is simply a method designed for advanced users.
To remove the virus utilizing ADB, you should:
- Install ADB tools on your computer.
- Enable improvement mode and option on your telephone USB debugging.
- Connect your telephone to your computer via USB cable and authorize the connection.
- Open the terminal on your computer (command line) and enter the following commands to halt and uninstall the malicious application (the package name ‘com.example.mysoul’ is an example):
adb shell am force-stop com.example.mysoul
adb uninstall com.example.mysoul
NOTE: If you have no experience of utilizing ADB, do not effort this method yourself. Invalid usage of commands can harm your telephone software. In that case, the safest solution is contacting a professional GSM serviceWhich will remove the virus safely. As a last resort, it may be essential to reconstruct your telephone to mill settings, resulting in the failure of all data.
Read more:
A dangerous virus attacks the phones of Poles. Experts inform you, he can clear the account!
