TECH

Hackers breach in-car Android systems in a new type of digital attack

Kaspersky has revealed a malware campaign that managed to infiltrate Android systems installed in the central control consoles of various car models. The investigation, conducted in June, identified a sophisticated scheme that exploited the update mechanism built into the console firmware, turning the vehicles into unexpected targets for malicious activity. According to the company, this is the first documented case of an attack specifically designed for this type of equipment, which combines multimedia functions with—in some instances—control over the vehicle itself.

Researchers discovered that the attack originated in a legitimate system component called TWCore, which is responsible for collecting analytics and managing software updates. This module received instructions from the manufacturer's server regarding which applications to install or update. Attackers exploited this channel to introduce a dropper named JarService, which initiated a multi-stage infection chain that was both stealthy and difficult to detect. The malware installed itself like a standard application but lacked a visible interface, running silently in the background.

Nine distinct commands were identified, allowing operators to display unwanted ads, commit ad fraud, and download additional modules. The software also gathered device information, such as the model, screen resolution, connected Wi-Fi network, and MAC address. Although these units rarely store sensitive personal data, many maintain constant internet access and even support SIM cards. This makes them attractive targets for those seeking to expand botnets or exploit home networks via illicit proxies.

Technical analysis led researchers to link this campaign to the MoYu group, which is associated with the BadBox botnet. This botnet comprises Android devices compromised at the factory—including TV boxes, smartphones, and tablets. Operators use these devices for ad fraud, data theft, and the creation of proxy networks. The company found similarities between the control panel used in this attack and proxy services such as PXYEDGE and ProxyForU, reinforcing the link to the BadBox ecosystem.

DoFun, the manufacturer of the affected units, was notified by Kaspersky and has confirmed that the issue has been fixed. However, researchers warn that this case demonstrates a worrying trend: hackers are exploiting increasingly diverse and sophisticated methods to distribute malware, ranging from pre-installed backdoors to compromised IPTV applications. They are now targeting automotive platforms, which had not previously been considered a priority target.

For Kaspersky, this incident serves as a warning that the digital systems in modern cars require robust, ongoing protection against emerging threats. "Despite efforts by cybersecurity experts and authorities to dismantle the BadBox botnet, individual actors associated with it continue to carry out malicious activities, infecting devices worldwide," notes Kaspersky security researcher Dmitry Kalinin.

Create a botnet...This is the first documented case of malware infecting a car head unit via an attack specifically designed for this type of device, according to a report by a Russian company published on Friday.

The malware was found on head units manufactured by DoFun, a Chinese automotive software and hardware supplier whose systems are widely used in China and other Asia-Pacific countries. Researchers attributed the campaign with high confidence to the MoYu Group, a threat actor linked to the BadBox malware operation, which has previously compromised Android smartphones, tablets, streaming devices, and other internet-connected products.

Infection and functionalities...Kaspersky traced the infections to TWCore, a legitimate system application installed on DoFun devices that collects analytics and manages software updates. Attackers abused this functionality to push a malicious app called JarService to affected devices without requiring drivers to click a link or install anything, the report detailed.

JarService has no visible user interface and acts as a downloader for additional malicious code, making it difficult for drivers to notice the compromise. The malware can display ads and generate fraudulent clicks, but its ultimate goal appears to be expanding a botnet. One observed module turns infected units into reverse proxies, allowing other people's internet traffic to be routed through the infected device.

BadBox context...BadBox has previously been linked to malware installed on Android devices before they reached consumers. In December 2024, German authorities disrupted the original BadBox botnet by cutting off communications between infected devices and the hackers' command-and-control infrastructure, but the criminals quickly resurfaced with an updated version. The FBI also warned last year that BadBox 2.0 was targeting IoT devices, including aftermarket vehicle infotainment systems.

mundophone

TECH

Study identifies potential savings in material requirements for wind energy expansion

For their analysis, the researchers reconstructed the development of Germany’s wind turbine fleet since 1988 and modelled various scenarios for its future development up to 2050. Among other things, they examined the material requirements for concrete, steel, copper, aluminium, polymers and composite materials. The study makes it clear that the further expansion of wind energy is associated with a considerable demand for materials. At the same time, the results show that the specific design of repowering measures is crucial for resource efficiency. In particular, the reuse of foundations, infrastructure components and other plant parts can significantly reduce material requirements.

The study analyses material flows and resource efficiency in the wind energy sector. Against the backdrop of wind energy expansion targets, it examines how future expansion can be organised in a way that conserves resources as much as possible. In doing so, it provides a scientific basis for assessing material requirements and potential savings in relation to wind turbines.

“Our aim was to systematically examine the material requirements of different expansion and repowering pathways and to highlight potential for material savings,” emphasises Christoph Helbig, Professor of Ecological Resource Technology and co-author of the study. “The results show that reuse strategies can be an important lever for combining resource efficiency with expansion targets.” The recycling of the wind turbines after their use was not part of this assessment.

In public debate, reference is often made to the absolute quantities of materials required for the construction and refurbishment of wind turbines. The study confirms that wind turbines consist of significant quantities of various raw materials and that their expansion requires corresponding resources. However, the key scientific finding of the study does not lie solely in quantifying these material requirements. Rather, a key finding concerns the potential to reduce future resource consumption through appropriate repowering strategies. 

Repowering refers to the replacement of older wind turbines with modern, more powerful ones. In the repowering scenario, in which the foundations, towers, and parts of the wind farm infrastructure are reused, the demand for concrete for onshore wind expansion is reduced by 14%, steel by 10%, and copper by 7% compared to a repowering scenario without reuse. For German offshore wind farms, cumulative copper demand would fall by 11% in the repowering scenario with reuse of the infrastructure. The analysis shows that, in particular, approaches to reusing foundations and infrastructure components can enable substantial material savings.

The researchers view their work as a contribution to a fact-based assessment of resource issues in the energy sector. Material requirements, the availability of raw materials, reuse and the circular economy are becoming increasingly important as the energy system undergoes transformation. The study provides a quantitative basis for this and highlights the options available for reducing resource use in the wind energy sector.

The University of Bayreuth points out that no blanket conclusions for or against a particular energy technology can be drawn from the study’s findings. Rather, the study provides scientific insights into how material flows are developing and what options are available for improving resource efficiency.

North Sea wind farm expansion may shift rain offshore, simulations suggest...Offshore wind farms are a key pillar of the energy transition. The European Union plans to expand offshore wind capacity in the North Sea by 2050. A new study by the Helmholtz-Zentrum Hereon indicates that a very extensive expansion could influence regional precipitation patterns: While precipitation over the sea could increase, it could decrease in coastal regions.

The research provides comprehensive insights into the potential regional climate impacts of future offshore wind farms, which the researchers emphasize must always be planned in harmony with the environment.

Researchers at Hereon's Institute of Coastal Systems—Analysis and Modeling used the high-resolution regional climate model COSMO-CLM to simulate various technical offshore wind energy expansion scenarios. The simulations were based on weather data covering the period from 2008 to 2017.

By analyzing an entire decade, the researchers were able to derive mean atmospheric dynamics across a wide range of weather conditions while reducing the influence of year-to-year variability. This approach allows potential long-term effects to be identified more robustly. The simulations included both existing and potential future offshore wind farm areas in the North Sea and Baltic Sea.

The researchers also considered the effects of wind turbines on wind speed, atmospheric mixing and moisture transport. Their aim was to gain a better understanding of the fundamental atmospheric processes that could be triggered by large offshore wind farm clusters. "Our work helps ensure that the further expansion of offshore wind energy in Europe can be aligned with the requirements of climate protection, environmental protection and coastal management," says Dr. Naveed Akhtar, lead author of the study.

A deliberately extreme expansion scenario...The scenario simulated in the study represents a purely technical expansion pathway that exceeds the European Union's current offshore wind deployment targets. It includes all designated areas in the North Sea and Baltic Sea that have been identified for potential offshore wind energy development. For these areas, the researchers assumed maximum deployment, resulting in an installed capacity that would substantially exceed the currently discussed target of 300 GW by 2050.

The researchers deliberately chose this scenario to make potential climate effects clearly detectable and estimate their magnitude. The rationale is that considerable uncertainty remains regarding which areas will ultimately be developed and how political targets may evolve in the future.

Precipitation patterns change...The results show that a large-scale expansion of offshore wind energy could lead to increased precipitation over offshore wind farm areas, while precipitation in adjacent coastal regions could decrease. The underlying mechanism is that wind turbines extract part of the wind's kinetic energy and simultaneously increase atmospheric turbulence.

Downstream of the turbines, strong variations in air movement enhance the exchange between different layers of the atmosphere. As a result, moist air can rise, cool and condense, leading to cloud formation and precipitation over the wind farms.

At the same time, the transport of moisture toward the coast is altered. If air masses release a greater share of their moisture as precipitation over offshore wind farm areas, less moisture remains available for precipitation in coastal regions. For parts of Denmark, Germany, the Netherlands and the United Kingdom, the simulations indicate potential reductions in coastal precipitation of up to 15%.

Long-term weather statistics rather than individual weather events...These findings can support sustainable maritime spatial planning and strengthen cross-border cooperation in the North Sea and Baltic Sea region. Previous studies by Hereon have shown that factors such as the size, layout and spacing of wind turbines can have a significant influence on atmospheric effects.

Future research should investigate a range of expansion scenarios and analyze how parameters such as turbine density, wind farm size and spatial distribution affect the regional climate. In addition, the researchers plan to further explore the impacts of offshore wind farms on the ocean and marine ecosystems.

source: Ecological Resource Technology

TECH

This mini ITX motherboard sports up to 96 GB DDR5 RAM and 12-core AMD Zen 5 chip

Axiomtek has introduced a new Zen 5-powered mini-ITX motherboard aimed particularly at gaming. The product is powered by up to a 12-core Ryzen AI Embedded P100 APU and can be equipped with 96 GB of DDR5 RAM.

Mini-ITX boards with soldered embedded processors from AMD and Intel are quite common, aimed primarily at industrial applications. However, the new GMB150 Mini-ITX board from Axiomtek takes a different approach, targeting gaming applications instead of typical industrial workloads.

This is possible thanks to the AMD Ryzen P100 series APUs powering the GMB150 motherboard. The P100 family features anywhere between 4 to 12 Zen 5 cores, along with iGPUs ranging from 2 to 16 CUs based on RDNA 3.5.

The performance of the upper-end Ryzen P100 chips should be almost the same as their "Gorgon Point" consumer counterparts. To be more specific, the GMB150 will be equipped with up to the AMD Ryzen AI P185 APU featuring a total of 12 cores and 24 threads. The APU is nearly identical to the Ryzen AI 9 HX 470, with the biggest difference being a 100 MHz lower boost clock and a more modest power envelope.

Therefore, it can be said that the highest-end GMB150 motherboard will be quite a performant part, and should be able to keep up with modern high-end Intel Panther Lake and AMD Gorgon Point-powered systems. 

Lower-end variants with the 4-core Ryzen AI P121, 6-core P132, 8-core P164, and 10-core P174-powered configurations will also be available. 

The motherboard sports dual DDR5-5600 SODIMM slots, which can be equipped with up to 96 GB of RAM. Storage requirements, on the other hand, are taken care of by a single M.2 2280 slot and dual SATA 3 ports. The I/O on offer has been detailed below:

Triple USB 2.0 Type-A, single USB 3.2 Gen 1

Two RS-232 COM ports, four RS-232 box headers

Dual USB 2.0 box headers, single USB 3.2 Gen 1 x1 Type-A (internal)

Dual 1G Ethernet

8-bit GPIO header

Multiple expansion pathways are also possible courtesy of a single PCIe x8 slot (physical x16), a single M.2 2230 slot, and dual PCIe-based proprietary "Golden Finger" expansion connectors for I/O modules from Axiomtek.

The GMB150 will be available soon according to Axiomtek, although its pricing details are yet to be revealed. Interested customers can contact Axiomtek directly in order to get a quote, which is likely to depend on order volume.

Typical consumers looking for a similarly powerful gaming mini PC can check out something like the Minisforum Ai X1 mini PC, powered by the Ryzen AI 9 HX 470 Gorgon Point APU.

mundophone

TECH

Why does so much laboratory plastic end up in the trash, even though it is recyclable?

Laboratories require disposable plastic for a simple reason: to prevent contamination. Bottles, Petri dishes, and pipette tips are used daily; once they come into contact with potentially contaminated samples, they can no longer follow the standard recycling path. For years, this meant sterilization, transport, and often, final disposal. Now, a new technology aims to change this dynamic right where the waste is generated.

The paradox arises once the experiment ends. Many laboratory containers are made from plastics that could otherwise be recycled. The problem is that, after coming into contact with microorganisms or certain substances, they are classified as contaminated waste.

This completely changes their fate.

Instead of entering a conventional recycling stream, these materials must undergo specific decontamination processes. Often, they are sterilized in autoclaves—equipment that uses high-pressure steam. Even after this treatment, some of the waste may still end up in landfills or be incinerated.

The result is a counterintuitive situation: an object made of recyclable material can turn into trash simply because it was used in a laboratory.

This is where a new approach comes in. Instead of transporting waste to an off-site facility, a machine allows various treatment stages to be carried out within the laboratory itself.

The equipment decontaminates the materials and then shreds them. The result is fragments that can be sent for sorting and subsequent recovery.

The goal isn't to instantly turn a used bottle into a new one. The objective is more fundamental—and perhaps more important: to remove the obstacle preventing the waste from re-entering the recycling stream.

In Scotland, the experiment has already processed thousands of bottles...The technology is called GENERATIONS and was developed by Envetec Sustainable Technologies. Scottish Water, the public utility responsible for water supply in Scotland, decided to put the system to the test.

Since January, the system has processed approximately 72,000 bottles used for sample collection. This initiative made the company the first water utility in the world to use such a system, according to an announcement released by Scottish Water itself.

But the bottles are just the beginning. The system is now also being used for materials that are harder to send for conventional recycling, such as Petri dishes and pipette tips.

The importance of this shift becomes clearer when looking at the scale of the problem. Scottish Water’s laboratories conduct around 3 million analyses annually, examining samples from various locations across Scotland to monitor water quality, identify microorganisms, and track environmental parameters.

This volume generates a significant amount of plastic waste.

The Scottish initiative therefore seeks to transform an unavoidable stage of scientific activity. Instead of automatically treating certain products as trash after use, the idea is to determine whether they can be decontaminated and prepared for a recovery process.

A solution to a much larger problem...The challenge is far from unique to Scottish Water. The University of Bath estimates that scientific research accounts for approximately 2% of global plastic waste and calculates that a life sciences laboratory professional can generate about 116 kilograms of waste per year.

The reason for so much disposable plastic is understandable. In scientific settings, reusing a pipette tip or other material that has come into contact with a sample can lead to contamination, alter results, and compromise critical analyses.

The technology, therefore, does not aim simply to eliminate disposable products. Instead, it seeks to address what happens after they have served their purpose.

Another interesting feature of the system is traceability. The equipment records data such as the volume processed, the types of polymers involved, the origin of the waste, and the material's ultimate destination. It also allows for estimates of the emissions that could have been avoided. This can help answer a fundamental question: did the plastic really return to the recovery chain, or did it simply change location?

If the experiment demonstrates consistent results on a larger scale, the technology could spark interest among universities, hospitals, and research centers. After all, the issue lies not only in the amount of plastic used in science but also in the difficulty of recovering materials that—despite being technically recyclable—pose a biohazard risk.

The machine does not eliminate laboratories' reliance on disposable plastic. However, it can address one of the most challenging aspects of the problem: preventing contamination from turning potentially recyclable material into permanent waste.

mundophone

 

DIGITAL LIFE

OpenAI blocks Russian-origin AI influence campaign

An AI-driven influence campaign used ChatGPT to create posts promoting an entity presented as an Israel-based think tank. OpenAI blocked the associated accounts after concluding they likely originated in Russia.

The operation promoted the "International Burke Institute" through content published on X, LinkedIn, Facebook, Substack, and Telegram. The institute featured experts, academic articles, and a "sovereignty index," but an analysis revealed plagiarized texts, false attributions, and content favorable to Russia.

Key points:

OpenAI blocked a set of ChatGPT accounts likely originating in Russia.

The operators used the platform to create posts and comments for social media.

Analysis found 34 plagiarized articles in a sample of 36 pieces of content associated with the institute.

Most posts saw little engagement, although some Telegram channels amassed between 10,000 and 20,000 followers.

OpenAI announced the account blocks on August 25 in a report on the influence operation. The company stated that users accessed ChatGPT from Russia using virtual private networks (VPNs).

Access to OpenAI models is not available in Russia. VPNs allowed the accounts to mask their actual location and bypass this restriction.

The operators wrote prompts in Russian but requested content primarily in English. Some requests specified the removal of linguistic traits that might reveal the authors' Russian origin.

OpenAI identified ChatGPT-generated text in posts on X, LinkedIn, Facebook, Substack, and Telegram. Some accounts used the International Burke Institute's name and visual identity. Others posed as ordinary users and primarily shared links to the entity's content.

ChatGPT was also used to generate replies to posts by real users on Substack. These messages typically recommended that readers follow the institute's channel. The investigation also uncovered German-language posts targeting Ukraine, the European Union, and the German government. Another operator requested images for approximately 12 Telegram channels focused on Germany, the United States, France, Poland, and Turkey.

Attribution requires caution. OpenAI considers it highly likely that the accounts originated in Russia but presented no evidence of a direct link to the Russian government.

The institute used plagiarized academic content...Most of the activity promoted the International Burke Institute, also known by the acronym IBI. Its website was registered in February 2025 and presented the organization as an international community of experts based in Israel.

The page linked well-known figures from academia and politics to the institute. Among them were Francis Fukuyama, Noam Chomsky, and former U.S. Secretary of State Mike Pompeo.

OpenAI’s research analyzed a sample of 36 articles published between September 2025 and May 2026. The company concluded that 34 of them had been copied from other online sources.

Some texts were years old. Others were attributed to authors who had not written them. One article about the China-Pakistan economic corridor, for instance, reproduced a work published by Cambridge University Press but attributed the content to a different researcher.

In another instance, the site linked an article on migration policy to an Australian food chemistry professor. The original text had been published by the Migration Policy Institute and was authored by others.

An independent investigation by *Le Monde* also found references to alleged partnerships with international organizations. UNICEF confirmed to the newspaper that the International Burke Institute was not an approved partner and that there was no record of any joint work.

These elements created an appearance of academic authority. The plagiarized content gave the site a documentary foundation that could seem legitimate to a reader who did not verify the original authors and publications. OpenAI found no evidence that the items hosted on the site had been produced by its models. ChatGPT's role focused primarily on creating promotional posts for social media.

Artificial intelligence supported the distribution of the campaign... The International Burke Institute also published an index designed to assess national sovereignty. The methodology placed Russia in a favorable position while presenting negative assessments of France, Germany, the European Union, and the United States.

The texts argued that Western European countries had lost political and economic autonomy. They also criticized European support for Ukraine and advocated for better relations with Russia.

Using a proprietary index lent the messages a quantitative appearance. Operators could present political opinions as the results of an institutional methodology, even without demonstrating the validity of the criteria used.

ChatGPT served to amplify the distribution of this content. Instead of building an entire infrastructure from scratch, the model generated messages tailored to different platforms and audiences.

This distinction is crucial for understanding the role of artificial intelligence in influence operations. While the technology can reduce the time and cost required to produce content in multiple languages, it still relies on websites, accounts, channels, and distribution mechanisms.

In this instance, the use of ChatGPT also contributed to the operation's detection. By analyzing accounts and requests, OpenAI was able to link scattered posts to the International Burke Institute and the channels promoting its content.

OpenAI considers the campaign's immediate impact to have been limited. Social media posts generally garnered few views and interactions, and the institute's official accounts had few subscribers.

Telegram channels boasted larger audiences; according to the company, several had between 10,000 and 20,000 followers. These figures do not, in themselves, confirm that the followers were authentic or that they engaged with the content.

Using the impact scale developed by the Brookings Institution, OpenAI placed the operation at the lower end of category three. This classification corresponds to activity spanning multiple platforms, with some evidence of contact with real audiences.

The case is significant primarily due to its infrastructure. The operation brought together an entity with an institutional appearance, alleged experts, academic content, a proprietary index, and distribution channels across several countries.

*Le Monde* also identified individuals physically present in Israel who were associated with the institute or the promotion of the index. OpenAI stated that it was unable to determine the relationship between these individuals, the IBI, and the operators based in Russia.

To date, there is also no proven link between the institute and the Social Design Agency, an entity associated with other Russian disinformation campaigns. However, previously released documents outlined plans to establish a think tank in Israel capable of distributing content through Western media outlets.

The case demonstrates that artificial intelligence can serve as a component of broader operations aimed at manufacturing credibility. A limited initial reach does not eliminate the risk that such an infrastructure could expand, gain recognition, and serve as an apparent source for political content.

mundophone

TECH

In Lucia GTA 6 leak, Cyberleek hints at release date delay with game not ready

According to Cyberleek, GTA 6 is in rough shape only months ahead of its release date. The leaker hints at a delay in the Lucia prologue video, which only contains minimal spoilers. Insiders believe that the Rockstar build is either very recent or more than a year old.

After winning a vote, Cyberleek’s latest GTA 6 leak features Lucia in a portion of the game’s prologue. While fans feared spoilers, it only briefly delves into the character’s backstory. The larger development may be the claim that the video is from a recent build. Rockstar’s tormentor also suggests that the title will not be ready in time for its November release date.

The video begins with an anxious Lucia sitting at a restaurant table. Apparently low on cash, she orders water before a waiter asks her to leave. The scene then switches to a prison, where Jason’s partner walks its confines with inmate chatter in the background. The clip ends with Lucia about to speak to a freshly assigned counselor.

Leading up to the new GTA 6 leak, there was speculation about how old the build Cyberleek accessed was. Following the debut of the first basketball gameplay video, insider NateTheHate said the footage was at least a year old. Bloomberg’s Jason Schreier later explained that the videos were from a more recent build.

During the Lucia prologue, Cyberleek adds a message that may spark fears of a GTA 6 release date delay. The leaker says, “This build is actually recent and the game is not ready at all.”

Most fans have praised the visual quality and detail showcased in earlier clips. Even so, viewers have identified bugs, like a glitchy NPC in Jason’s gas station encounter. Pop-in has also cropped up, particularly with objects like backpacks in the Vice City Beach footage.

Is a delay still possible? Cyberleek, who has protested Rockstar ditching discs, may be trying to cast doubt on the game’s success. Schreier recently revealed that the title is “pretty close to being finished,” and that developers are in their final push. In Rockstar’s first response to the GTA 6 leaks on August 26th, the studio confirmed that the game was “nearly there!”

Despite the barrage of leaks, the August 27th GTA 6 Netflix Extended Look will still air on schedule. Previews from media outlets should appear following the broadcast.

mundophone

TECH

ToxicPanda 2.0: An Android banking Trojan and remote access tool designed for account takeover and "on-device fraud"

Researchers have discovered ToxicPanda 2.0, an Android banking Trojan and remote access tool designed for account takeover and "on-device fraud."

ToxicPanda 2.0 not only targets a much larger list of banks and e-wallets but has also expanded its capabilities by combining banking overlays, remote access, and PIN capture. It exploits Android accessibility services and attempts to automate wireless debugging. Together, these functions enable operators to turn a compromised phone into a platform for account takeover, financial fraud, and long-term device control.

The primary goal is on-device fraud. This means that instead of logging in from an attacker-controlled machine, the operator can perform actions from the victim's infected phone, taking control of the device, IP address, app session, and the behavioral context that banks use to determine whether a transaction is fraudulent.

ToxicPanda 2.0 relies on abusing Android's Accessibility Service—a legitimate feature designed to help people interact with their devices. When a victim grants this permission to a malicious app, the malware can inspect interface elements, monitor app activity, automate interactions, and overlay deceptive content onto legitimate apps (a technique known as "overlaying").

Historically, ToxicPanda has relied on social engineering to persuade users to manually install the malicious Android app rather than downloading it from Google Play. The latest campaign uses AWS-hosted Amazon S3 buckets to distribute ToxicPanda 2.0 samples.

Upon installation, the dropper presents a fake setup flow and issues permission requests. ...uses VPN privileges, blocks specific network communications from Google Play and Google Play Services, decrypts embedded content, and then requests Accessibility Service permission for the installed content.

Consequences may include the theft of banking usernames and passwords, interception or capture of PINs, fraudulent transactions, loss of device access, and exposure of the phone's screen-lock password. An attacker operating within an active banking session from the victim's device may be more likely to bypass controls designed to identify unknown devices or unusual login locations.

How to stay safe...Despite its sophistication, ToxicPanda 2.0 still relies heavily on social engineering to trick victims into installing the malicious app and granting the necessary permissions. Therefore, our key recommendations are:

Avoid installing apps from external sources, especially those linked in unsolicited messages, advertisements, or purported support communications.

Exercise extreme caution regarding requests for accessibility access, device administrator privileges, developer settings, and VPN permissions—especially if the app's need for these permissions is unclear or if you do not fully trust the app.

Use an up-to-date, real-time anti-malware solution on your device capable of detecting and blocking the malicious payload. Malwarebytes for Android detects apps from the ToxicPanda 2.0 campaign as... Android/Trojan.Dropper.agent and Android/Trojan.FakeApp.ACR2401245FC11.

If your device is infected...While a factory reset might be necessary to regain control of an infected device, there are a few things you can try first:

First, put your phone in airplane mode and turn off Wi-Fi and Bluetooth. This can disrupt command-and-control communications and prevent credential theft while you investigate. Use another device to freeze or closely monitor transactions, revoke active sessions, and reset your banking credentials.

Do not interact with fake "system update" screens or unexpected requests regarding accessibility, VPN, device administrator, developer options, or wireless debugging.

Start Android in Safe Mode. Google recommends Safe Mode to help identify issues caused by downloaded apps. Remove recently installed or suspicious apps one by one, restart the device normally, and check if the problem persists.

Start Android in Safe Mode. Google recommends Safe Mode to help identify issues caused by downloaded apps. Remove recently installed or suspicious apps one by one, restart the device normally, and check if the problem persists.

First, remove accessibility access. Go to Settings > Accessibility > Installed apps/Downloaded apps and disable any service you do not recognize. Focus on recently installed apps or anything posing as an update, system component, security tool, document viewer, or banking assistant.

Next, check device administrator rights. Go to Security & privacy > More security settings > Device admin apps and disable any unrecognized administrator before attempting removal. An app with device administrator privileges can make the uninstall option unavailable.

Then, check your VPNs. Go to Settings > Network & internet > VPN (or search for "VPN" in Settings) and delete any VPN profile you did not deliberately install. The ToxicPanda dropper uses VPN permissions as part of the process to block Google Play and Google Play Services.

Disable dangerous developer features. Search for "Developer options" in Settings, turn them off completely, and ensure that Wireless debugging and USB debugging are disabled.

Remove any suspicious apps you find. Go to Settings > Apps > See all apps, enable "Show system apps" if necessary, and locate recently installed or unknown apps. Force stop the suspicious app, clear its storage, and select Uninstall. Consider an app suspicious if it has a generic name, a blank icon, an odd installation date, or was installed outside the Google Play Store.

Restart normally after removal, then re-check Accessibility, Device Admin apps, VPN settings, and Developer options. Also check the list of installed applications for a second suspicious package, since the reported campaign uses a dropper to decrypt and install its malicious content.

mundophone