ToxicPanda, also known as TgToxic, is an Android banking trojan active since July 2022. The updated version 2.0 features 167 remote commands, targets over 140 banking and cryptocurrency apps, and uses accessibility service abuse for credential theft. It now includes automated exploitation of Android Wireless Debugging for privilege escalation and uses AWS-hosted buckets for distribution.