TOXICPANDA 2.0 AND GOLDDIGGER EXPAND ANDROID BANKING ATTACKS WITH ON-DEVICE FRAUD

Summary from the TLDR InfoSec newsletter

ToxicPanda 2.0 expanded its overlay-based credential theft from 16 to 349 financial institutions across 16 countries, adding 167 remote commands, PIN harvesting across 140+ banking and crypto apps, and an accessibility-service abuse chain that enables Wireless Debugging via ADB for privilege escalation.