CuraSec

Learn active

ToxicPanda Android malware expands targets, abuses VPN to block Play Store

2026-08-24 11:41 UTC · BleepingComputer · read the source ↗ #android-malware#mobile-security#banking-malware
  • Engineer — Skip
  • SOC/IR — Learn: The VPN-permission-as-blocker technique is a noteworthy evasion TTP for mobile threat awareness, but the summary provides no IOCs or detection signatures to act on; file for context when tuning mobile EDR or MAM policies.
  • Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.