Anatsa Trojan: 90,000 Users Infected by Malicious PDF App on Google Play
A sophisticated Android banking malware campaign has infected 90,000 users across multiple countries, with the Anatsa trojan distributed through a malicious PDF app on the official Google Play Store.
Disguised as a Legitimate App
The Trojan masqueraded as a legitimate app called Document Viewer – File Reader, developed by Hybrid Cars Simulator, Drift & Racing. Initially functioning as a PDF viewer, the app embedded malicious code weeks after its launch, transforming it into a tool for attacks.
How the Attack Works
Anatsa, also known as TeaBot or Toddler, is a banking trojan active since 2020, designed to steal credentials, log keystrokes, and take over devices for automated fraudulent transactions.
The attackers follow a systematic approach:
- Publish a benign app on Google Play.
- Wait for it to gain thousands of installs and positive reviews.
- Push a malicious update that embeds a dropper.
- Silently install the Anatsa payload on devices.
Comment(s)
Recent Posts
