Android banking malware and hybrid ransomware threats

Security researchers continue to identify sophisticated Android malware strains designed to target banking applications, personal data, and cryptocurrency wallets.

ToxicPanda 2.0 has demonstrated a massive expansion, targeting 349 financial applications across 16 countries. The malware utilizes a complex infection chain where it poses as a legitimate application to request VPN permissions, subsequently blocking Google Play Protect to install malicious payloads. It abuses Android’s Accessibility Service to monitor screens and automate interactions, and exploits wireless debugging features to gain shell access to devices without user knowledge. Research indicates it is often distributed via Amazon AWS-hosted infrastructure and can deploy phishing overlays to deceive users.

Newer threats linked to Indonesian actors have introduced advanced evasion tactics. The Gigabud banking trojan, attributed to the GoldFactory threat group, has been updated to use a modified version of the Shelter app, known as Vwork, to clone legitimate banking applications into an isolated Android work profile. This allows the malware to circumvent security measures by operating in a profile where user alerts or security scans often fail to detect or correlate with malicious activity. This method has been confirmed in Indonesia—where estimated losses reached approximately $960,939 between February and July 2026—and targets 11 countries, including Brazil, Colombia, Mexico, Egypt, Laos, Morocco, the Philippines, Thailand, and Turkey. Infection typically begins via sideloaded apps disguised as government portals, airlines, or tax offices.

Additionally, the Mantax Otax strain represents a hybrid threat, integrating spyware with ransomware functionality. It performs extensive surveillance, including real-time screen recording and harvesting contact lists, before encrypting files on older Android versions. It utilizes an on-screen chat portal to facilitate real-time ransom negotiations, creating a double-extortion threat. These developments complement the Manic malware strain, which uses mesh networking to exfiltrate data without an active internet connection.