ToxicPanda is an evolving Android banking trojan that primarily targets banking and digital wallet credentials through sophisticated attack techniques. This malware is known for overlaying PINs and pattern codes, which allows cybercriminals to conduct unauthorized financial transactions directly from compromised devices. Initially identified in Southeast Asia in 2022, ToxicPanda has since shifted its focus to Europe, predominantly targeting Portugal and Spain as of early 2025, with a notable increase in installations, now affecting approximately 4,500 devices.