kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

TOXIC PANDA

also tracked as golddigger 1, toxicpanda 1

2 stories · 2 in the wild · August 22, 2026 – August 24, 2026

evidence: 2 observed

sectors

  • finance 2 · Aug 24
  • consumers 1 · Aug 24
  • crypto 1 · Aug 22

geography

  • india 1 · Aug 24

malware and tools

  • toxic panda 1 · Aug 24
  • golddigger 1 · Aug 22
  • toxicpanda 1 · Aug 22

techniques

  • permission abuse 1 · Aug 24
  • credential access 1 · Aug 22

attack phases seen

  • Defense evasion 1 · Aug 24
  • Execution 1 · Aug 24
  • Collection 1 · Aug 22
  • Credential access 1 · Aug 22

what we reported, newest first, grouped by story

Aug 22 – August 24, 2026 · 2 reports

  • ToxicPanda now abuses Android VPN permissions to cut victims off from Google Play, blocking Play Protect updates while it operates (BleepingComputer) (earlier coverage). Separately, Indian government blocking notices show Android malware impersonating ICICI, SBI and Axis banking apps using Firebase infrastructure (Ministry of Cyber Affairs). · Aug 24 · observed · Threat Activity & Cybercrime
  • ToxicPanda 2.0 adds 167 remote commands and a PIN-harvesting workflow against 140+ banking and crypto apps, expanding globally alongside GoldDigger's on-device fraud capabilities (The Hacker News). · Aug 22 · observed · as toxicpanda, golddigger · Threat Activity