AI Weekly Malaysia

Zimperium zLabs reports ToxicPanda 2.0 (aka TgToxic) has expanded from targeting 16 banking apps to 349 financial institutions across 16 countries, with 167 remote commands and PIN harvesting via fake overlays. The malware abuses Android accessibility services to enable Wireless Debugging through ADB for privilege escalation, overwrites lock screen PINs, and exempts itself from battery optimization to persist in the background.

Why: If you build or ship Android fintech or banking apps in Southeast Asia, your users are now in the expanded targeting scope of a malware that can harvest credentials and escalate to shell-level access via accessibility services. Review whether your app detects accessibility-service abuse or warns users, since the attack chain relies on users granting accessibility permissions and Device Administrator privileges.

ThreatFabric has documented a new Android malware family called Manic, active since February 2026, that combines banking trojan and spyware capabilities. Its standout feature is a Wi-Fi mesh relay technique allowing infected offline devices to exfiltrate data through nearby compromised devices with internet access. It targets 169 package IDs including Ukrainian, Russian, and European banking, government, crypto, and messaging apps, distributed via phishing sites and dropper apps impersonating utilities.

Why: If you build Android apps handling payments, identity, or sensitive communications, the Wi-Fi mesh exfiltration technique means offline or air-gapped assumptions no longer hold—review whether your app's local data encryption and lock-screen credential handling are robust against relay-based exfiltration. For Malaysian builders shipping fintech or e-government apps, the 169-package target list and the impersonation-of-utilities distribution method are worth studying as a threat model, though no Malaysian apps are currently listed as targets.