Researchers discovered over 90 malicious Android apps with more than 5.5 million downloads, spread through Google Play to distribute malware and adware. In addition, an increased spread of the Anatsa banking trojan.
Anatsa banking trojan
Anatsa (also known as “Teabot”) is a banking trojan that targets over 650 financial institution applications in Europe, the US, the UK and Asia. Its goal is to steal e-banking credentials to access accounts and make transactions.
In February 2024, Threat Fabric reported that Anatsa had achieved at least 150,000 infections via Google Play since late last year. It was misleading victims through fake apps in the productivity software category.
See also: Android banking trojan Antidot appears as a Google Play update
Now, Zscaler has spotted new malicious Anatsa apps on Google Play: “PDF Reader & File Manager” and “QR Reader & File Manager.” They have now been removed from the app store.
At the time the company analyzed the findings, the two apps had already accumulated 70,000 installs.
One thing that helps Anatsa applications evade detection is their multi-stage payload loading mechanism, which involves four different steps:
- The Dropper application retrieves the configuration and key strings from the C2 server
- The DEX file, containing the malicious Dropper, is downloaded and activated on the device
- Downloading the configuration file with the Anatsa payload URL
- The DEX file retrieves and installs the malware payload (APK), completing the infection
The DEX file performs anti-parsing checks to ensure that malware will not run in sandbox or emulating environments.
See also: 2023: Google banned 2.28 million dangerous apps from Google Play
Once Anatsa malware is executed on the device, it begins its activity.
Google Play: 90 malicious apps with millions of downloads
Zscaler says that in the past two months, it also discovered more than 90 malicious apps on Google Play, which were installed 5.5 million times.
Most malicious apps mimicutilities photography, productivity apps, and health and fitness apps.
Since malicious apps are also making their way into official app stores, users should always verify the authenticity of an app before installing it. This can be done reviews user.
See also: Google Play: VPN apps turned Android devices into proxies
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Additionally, users can visit the official website of a service and find the link there to download the application from the app store.
It's also important to check the permissions that apps request, even if they're on Google Play. If an app asks for access to personal information that doesn't seem necessary for it to function, it's best to avoid installing it.
It is also essential to use reliable security software and regularly update the operating system and applications. Finally, users should avoid sharing their personal information with untrusted sources.
Source: www.bleepingcomputer.com
