# ToxicPanda adds VPN blocking and wireless ADB abuse to Android toolkit

_Published Sunday, August 23, 2026 at 12:07 PM EDT · Security · Latest · Tier 2 — Notable_

![ToxicPanda adds VPN blocking and wireless ADB abuse to Android toolkit — Primary](https://www.bleepstatic.com/content/hl-images/2026/08/20/toxicpanda.jpg)

ToxicPanda 2.0 has added VPN-service permissions that let it block Google Play and Google Play Services communications, according to Zimperium's analysis. The malware blocks those channels before installing its payload, then seeks Accessibility Service permissions. Researchers said it can automate Wireless ADB to gain shell-level access, supports 167 remote commands, and uses phishing overlays targeting 349 banking, financial, cryptocurrency and e-wallet apps across 16 countries. Zimperium said the malware is distributed through Amazon AWS-hosted buckets.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/)

---
Canonical: https://techandbusiness.org/newswire/6HZ73Nxx38vpHjBIZZva9H
Published: 2026-08-23T16:07:12.547Z
Story chronology: 2026-08-23T14:23:46.000Z
Retrieved: 2026-10-08T00:14:38.548Z
Publisher: Tech & Business (techandbusiness.org)