Loading story…
The Android banking trojan TgToxic has evolved from a Southeast Asia-focused malware operation into a broader campaign targeting victims in Europe and Latin America, while continuing to steal banking credentials, cryptocurrency, and funds. Earlier reporting tied TgToxic to phishing and scam-themed lures delivered through malicious websites and messaging apps such as WhatsApp and Viber, where victims were pushed to install fake Android apps and grant dangerous permissions that enabled attackers to take automated control of infected devices.
Recent analysis found the operators significantly upgraded the malware’s resilience and evasion. A second variant observed in late 2024 hid encrypted command-and-control data behind dead-drop resolvers on 25 community forums, and a third variant shifted to a domain generation algorithm (DGA) to make disruption harder. Newer samples also introduced stronger anti-emulation and anti-analysis checks, including hardware fingerprinting, Android feature validation, and emulator artifact detection, reinforcing assessments that the operators are actively adapting the trojan in response to public reporting and defensive scrutiny.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
From early December 2024, Intel 471 observed a third TgToxic variant that replaced forum-profile dead drops with a domain generation algorithm for command-and-control discovery. The change was assessed as improving resilience and possibly responding to reporting or account removals.
On November 22, 2024, Intel 471 researchers observed a campaign using an updated version of TgToxic. This second observed variant used dead-drop resolvers on 25 community forums to hide encrypted command-and-control information in forum profiles.
In October 2024, Cleafy published research on a new TgToxic version it called the ToxicPanda strain. Cleafy assessed it as still under development and said its targeted app list included European and Latin American banks, indicating geographic expansion beyond Southeast Asia.
Trend Micro described social-engineering campaigns targeting Android users in Taiwan, Indonesia, and Thailand with fake apps, phishing sites, and messaging-app lures. The report said the malware abused Easyclick and Autojs to automate control of infected devices after victims granted permissions.
Researchers observed many scams in Taiwan in August 2022 that abused allowance-assistance distribution themes, and an official agency in Taiwan warned the public about them. Campaign components tied to TgToxic reflected familiarity with these regional lures.
Trend Micro discovered the TgToxic Android banking trojan in July 2022. The malware was designed to steal credentials, cryptocurrency wallet assets, and funds from banking and finance applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourcetrendmicro.com
Open sourcecleafy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that leaked source code for the Android banking malware **GM Bot** enabled broader criminal reuse of a trojan capable of stealing banking credentials, intercepting SMS messages, and bypassing two-factor authentication. IBM said the malware—also tracked under names including **Slempo**, **Bankosy**, **Acecard**, and **MazarBot**—abused Android activity hijacking on older devices to display fake login overlays on legitimate banking apps, making the leak significant because it lowered the barrier for other actors to build or modify mobile banking trojans. ESET later linked publicly released Android banker and command-and-control source code from a Russian forum to an active banking botnet campaign distributed through trojanized weather apps on **Google Play**. The newer malware, detected as `Trojan.Android/Spy.Banker.HW`, posed as **World Weather**, expanded targeting from 22 Turkish banks to 69 banking apps across Turkey, the UK, Germany, and Austria, and added stronger obfuscation while retaining SMS interception and remote lock and unlock functions. An exposed control panel showed more than **2,800 infected devices**, and the hosting provider removed the C2 server after notification.
Aug 15, 2026
The **Godfather** Android banking trojan has been documented as an active mobile threat that steals financial, identity, and personal data from Android users through extensive device surveillance and account-takeover features. Technical reporting describes the malware abusing Android accessibility services for keylogging and screen interaction monitoring, while also stealing SMS messages and notifications to intercept authentication flows and bypass **2FA**. Researchers said the malware also supports **VNC-style remote control**, proxying, and command-and-control communications, giving operators broad visibility into infected devices and the ability to manipulate sessions tied to banking and other sensitive apps. Analysis of the malware shows Godfather relying on runtime string decryption with **Blowfish**, dynamically retrieving targeted application lists from its C2 infrastructure, and obtaining C2 details from a **Telegram account description** to complicate tracking and takedown efforts. Reporting cited prior observations that the trojan targeted more than **400 financial organizations** between 2021 and 2022, with renewed campaigns focusing heavily on **Turkey** and using fake music applications as an infection vector. Reverse-engineering materials and public research repositories have since published notes, slides, code, and marked-up samples to help defenders better understand the malware's behavior and detection opportunities.
Aug 15, 2026
Researchers reported a renewed wave of **TrickMo** Android malware activity, showing that the banking trojan has evolved from its earlier role in German banking fraud into a broader mobile credential- and data-theft platform. First associated with campaigns that pushed a fake security app to bank customers in Germany to intercept transaction authentication numbers and bypass **2FA**, newer 2023 samples were found masquerading as apps including **Google Chrome** and **OnStream** while continuing to abuse Android **Accessibility Services** to control infected devices and steal sensitive information. The latest variants replaced earlier screen-recording behavior with **HTML/WebView overlay attacks** designed to capture credentials from banking, cryptocurrency, email, commerce, and social media apps. Analysts said the malware communicates with a command-and-control server at `keepass[.]ltd` (`194.169.175[.]138`), uses **JsonPacker** obfuscation, and now supports **45 commands** covering SMS interception, call-log collection, photo and video exfiltration, USSD dialing, icon changes, runtime module downloads, and automated tapping via `clicker.json`; its Android tradecraft also aligns with ATT&CK technique **`T1624.001`** for event-triggered execution through broadcast receivers.
Aug 15, 2026