← Back to Feed
ToxicPanda Android malware uses VPN permissions to block Google Play
August 23, 2026 · BleepingComputer · Severity: HIGH
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.
Key Takeaways
- ToxicPanda Android malware uses VPN permissions to block Google Play Store and prevent users from installing security updates.
- The malware has expanded its targeting to 349 apps, up from its initial focus on Italian banking apps.
- ToxicPanda has extended its geographic reach from Italy to multiple European countries.