Malicious Apps on PlayStore: Shielding Against the Anatsa Trojan

Recently, the Anatsa banking trojan, also known as Teabot, has resurfaced on the Google Play Store, disguised as legitimate apps like PDF Reader & File Manager and QR Reader & File Manager. Discovered in 2021, Anatsa has infected over 150,000 devices, exploiting various productivity apps as bait. Its capabilities include taking screenshots, keylogging, and intercepting two-factor authentication (2FA) codes through call interception and overlay windows mimicking legitimate apps. The malware uses sophisticated techniques like overlay attacks to display fake login screens, tricking users into providing their banking credentials. It also performs anti-analysis checks to avoid detection in sandbox or emulated environments.

Once active, Anatsa downloads injections tailored to the victim’s profile and location, ensuring a high success rate for data theft. Zscaler’s research revealed that Anatsa requests intermediate DEX code from its command and control (C2) server, checks for malware analysis tools, and, if no tools are detected, downloads the final payload, completing the infection. According to Ashan Perera of Tinexta Cyber, many attackers target the most downloaded app categories, making it difficult for users to identify which apps are safe. To defend against Anatsa and similar threats, users should download apps only from trusted developers with positive reviews, carefully review app permissions, and use reputable mobile security solutions to detect and block malware.

Awareness and education are crucial. Users often unknowingly grant extensive permissions to apps. Regularly updating mobile security practices and staying informed about the latest threats can help mitigate risks. The discovery of over 90 malicious apps on Google Play in the last two months, including Joker, Facestealer, Anatsa, Coper, and various adware, underscores the urgency of adopting stricter security measures.

Source: Cybersecurity360

To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.