# ToxicPanda adds VPN blocking and wireless ADB abuse to Android toolkit

_Sunday, August 23, 2026 at 10:23 AM EDT · Security · Latest · Tier 2 — Notable_

![ToxicPanda adds VPN blocking and wireless ADB abuse to Android toolkit — Primary](https://www.bleepstatic.com/content/hl-images/2026/08/20/toxicpanda.jpg)

ToxicPanda 2.0 has added VPN-service permissions that let it block Google Play and Google Play Services communications, according to Zimperium's analysis. The malware blocks those channels before installing its payload, then seeks Accessibility Service permissions. Researchers said it can automate Wireless ADB to gain shell-level access, supports 167 remote commands, and uses phishing overlays targeting 349 banking, financial, cryptocurrency and e-wallet apps across 16 countries. Zimperium said the malware is distributed through Amazon AWS-hosted buckets.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/)

---
Canonical: https://techandbusiness.org/newswire/6HZ73Nxx38vpHjBIZZva9H
Retrieved: 2026-08-23T17:53:07.056Z
Publisher: Tech & Business (techandbusiness.org)