ToxicPanda 2.0 talks its way to an ADB shell, so wireless debugging belongs in the baseline

Almost none of this is exploitation. The chain rests on two consent dialogs: a VPN permission request dressed up as part of the installer ^[1], and an Accessibility prompt raised after the dropper decrypts and installs an encrypted payload from its own assets ^[3]. Those are the only two moments a human is asked to approve anything ^[1]. After that the handset operates itself. Accessibility reads the settings screen and taps "Build number" seven times when Developer Options are off ^[4], then walks to Wireless Debugging, switches it on, and opens "Pair device with pairing code" ^[5].

The pairing gate is where the platform assumption fails. Android protects local ADB pairing with a six-digit code and a dynamic port printed on the display ^[6], which is a million candidates for anything that has to guess ^[2]. Accessibility does not guess, because reading the screen is the whole point of the API. Pairing then completes against the ADB daemon on 127.0.0.1 using SPAKE2/TLS ^[7], and no externally exposed debug port is involved anywhere in the sequence ^[16].

The prize is the shell user rather than root. Zimperium describes shell-level commands used to grant runtime permissions, relax background limits, enable the components the malware needs, and establish persistence ^[8], with no root access or kernel exploit in the initial reporting ^[9]. The report scopes affected products to Android 11 and later ^[21]. Anyone triaging by patch level or root-detection signal will find nothing to look at.

The theft stage is ordinary by comparison. Installed package names and icons go to the C2 so operators can decide which financial apps are worth targeting ^[10], a fake HTML screen is served and drawn over the real login or transaction view ^[11], a transparent overlay records touch positions to lift the app PIN while a separate fake lock screen collects the device PIN, pattern or password ^[12], and after the first HTTPS request a single encrypted WebSocket stays open to carry commands and collected data ^[13].

The observable that matters is not malware at all, it is configuration drift with a timestamp. The settings screen opens on its own, and Developer Options or Wireless Debugging can flip on within a short window ^[23], possibly behind a fake system update screen placed in front to hide the activity ^[20]. On the network side the report points at the AWS distribution links, the initial HTTPS callback, long-running WebSockets and traffic to published IOCs ^[18]. Until the delivery step is documented, those two toggles and the two grants are the only parts of the chain that a written policy can actually reach.