diff --git a/clusters/tool.json b/clusters/tool.json
index 0319b2e..38bddaf 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -8691,7 +8691,17 @@
       ],
       "uuid": "cd32b19e-c365-4efc-9998-548e50e04a4c",
       "value": "FakeUpdates"
+    },
+    {
+      "description": "Banking trojan named TgToxic (detected by Trend Micro as AndroidOS_TgToxic based on its special encrypted filename) embedded in multiple fake apps.",
+      "meta": {
+        "refs": [
+          "https://www.trendmicro.com/en_us/research/23/b/tgtoxic-malware-targets-southeast-asia-android-users.html"
+        ]
+      },
+      "uuid": "55d5853c-393e-449b-ab2b-871e3fe45288",
+      "value": "TgToxic"
     }
   ],
-  "version": 159
+  "version": 160
 }