A newly upgraded Android banking trojan called ToxicPanda 2.0 has been observed using a deceptive VPN permission request to bypass Google Play Protect and steal sensitive financial data. Security researchers identified the malware in August 2026, noting its ability to masquerade as a legitimate network security tool while silently disabling on-device protections. The attack begins when users are tricked into granting VPN access through a fake prompt that mimics standard Android security dialogs.
Once the malicious VPN connection is established, ToxicPanda 2.0 routes all device traffic through attacker-controlled servers, effectively isolating the phone from Google’s security monitoring systems. This allows the trojan to operate undetected while harvesting login credentials, session tokens, and other banking information from compromised applications. The malware specifically targets financial apps by overlaying fake login screens and capturing keystrokes through accessibility services.
The trojan presents users with a convincing notification claiming to enhance privacy or secure their connection, urging them to enable a VPN service. Unlike legitimate VPNs, this one does not encrypt traffic but instead creates a local proxy that intercepts and redirects data. By abusing Android’s VPN API, the malware gains persistent network control without triggering typical security alerts. Researchers noted that the fake prompt closely resembles system-level dialogs, making it difficult for average users to distinguish from genuine security requests.
Early signs include unexpected VPN activation notifications, unexplained battery drain, or sluggish device performance after granting network permissions. Security experts advise users to review VPN settings regularly and revoke access for any unfamiliar or suspicious applications. Enabling Google Play Protect’s enhanced scanning and keeping Android OS updated to the latest version can also reduce risk. However, because the trojan operates at the network level, traditional antivirus tools may struggle to detect it until after data theft has occurred.
How does ToxicPanda 2.0 avoid detection by Google Play Protect? It uses a fake VPN connection to route traffic through malicious servers, which prevents Play Protect from scanning apps and monitoring behavior in real time.
What should I do if I see an unexpected VPN prompt? Do not grant permission. Immediately check installed apps for unfamiliar entries, revoke any suspicious VPN access, and run a security scan using trusted tools.
Is this malware limited to certain regions or devices? Reports indicate global distribution, primarily targeting Android devices running versions 10 through 13, with no evidence of iOS involvement.