According to Threat Fabric researchers who spotted the latest campaign and reported it to Google, Anatsa shows users a fake message when they open the targeted apps, informing of a scheduled banking system maintenance. Anatsa periodically finds ways to infiltrate Google Play, so users should only trust apps from reputable publishers, check user reviews, pay attention to the requested permissions, and keep the number of installed apps on your device at the necessary minimum. In May 2024, mobile security firm Zscaler reported that Anatsa had achieved yet another infiltration on Android’s official app store, with two apps posing as a PDF reader and a QR reader, collectively amassing 70,000 downloads. The malware becomes active on the device immediately after installing the app, tracking users launching North American banking apps and serving them an overlay that allows accessing the account, keylogging, or automating transactions. The Anatsa banking trojan has sneaked into Google Play once more via an app posing as a PDF viewer that counted more than 50,000 downloads. Threat Fabric has been tracking Anatsa on Google Play for years, uncovering multiple infiltrations under fake or trojanized utility and productivity tools.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 08 Jul 2025 15:15:12 +0000