An Android banking Trojan has resurfaced with a new variant that demonstrates a significant evolution toward full device compromise and persistent access, putting at risk not only mobile users but also the enterprise resources accessed from those devices.

ToxicPanda 2.0 expands substantially on its predecessor, adding 167 remote commands and broadening its targeting from 16 financial institutions to 349 banking, e-wallet, and cryptocurrency applications, according to recent research from Zimperium zLabs. The Trojan also adds more sophisticated techniques for compromising Android devices, including privilege escalation and shell-level access through Android's Wireless Debugging and Android Debug Bridge (ADB), as well as capabilities designed to maintain long-term persistence on infected devices. More here