Malicious App on The Google Play with 50K+ Downloads Deploy Anatsa Banking Malware

Anatsa, a banking malware, has been identified spreading via the Google Play Store, amassing over 50,000 downloads prior to detection. The application masqueraded as a document reader, deceiving users seeking legitimate file management solutions.

The Anatsa trojan poses a significant threat by targeting banking credentials and sensitive financial data from infected devices. It functions as an installer that deploys the full trojan payload once the application accesses a device.

Users who downloaded this counterfeit document reader inadvertently allowed the malware to operate with elevated permissions, facilitating financial theft and data extraction .

The distribution method through Google’s official marketplace leveraged user trust in authorized platforms, highlighting a breach in app store security screening processes. Zscaler ThreatLabz identified the malicious application and tracked its distribution network and command-and-control infrastructure.

The researchers confirmed the malware's link to banking theft operations, offering detailed technical indicators for detecting infected devices.

Analyzing the Malware’s Infection and Communication Mechanism

Understanding Anatsa's persistence on Android devices is crucial for prevention. Once installed, the trojan integrates into the operating system, monitoring user activity, especially banking interactions. It captures sensitive information through overlay attacks and credential logging.

The malware communicates with command-and-control servers , transmitting stolen banking details to attackers. This connection enables ongoing control over compromised devices, continuously feeding banking data to criminal operations.

Security experts advise removing suspicious document reader apps, verifying app authenticity through official channels, and enabling multi-factor authentication on banking accounts to mitigate risks.

Based on reporting by Cyber Security News.