It takes the phone's VPN slot and uses it to cut off Google Play — then installs the payload
2026-08-24Security
Zimperium's analysis of ToxicPanda 2.0 describes malware that claims the VPN permission, filters the device's own traffic, and blocks Google Play and Play Services so security updates and app verification cannot run. It targets 349 apps across 16 countries and supports 167 remote commands.