Overview
- Security firm Zscaler ThreatLabz identified a Play Store app called “PDF Reader” that appears legitimate but later downloaded the Anatsa banking Trojan to devices.
- Google removed the app from the Play Store after researchers disclosed indicators, but more than 10,000 installs had already been recorded and the number of infected devices is unknown.
- Anatsa requests Android accessibility permissions and uses overlays and keylogging to present fake login screens and capture passwords and SMS authentication codes.
- The app hid malicious behavior in test and sandbox environments and delivered the trojan later disguised as an update, a technique that can bypass Play Protect and automated checks.
- Users who installed the app are urged to uninstall it, run a mobile antivirus scan or factory reset if infection is suspected, contact their bank, change credentials, and use trusted security software going forward; researchers note Anatsa has run similar campaigns since at least 2020 targeting hundreds of banks and crypto platforms.