Android malware Anatsa found in fake PDF reader app

Security researchers from Zscaler ThreatLabz have identified a malicious Android application distributed via the Google Play Store that disguises itself as a legitimate PDF reader. The app, which has surpassed 10,000 installs, serves as an installer for the Anatsa malware, also known as TeaBot.

Anatsa is a banking trojan designed to target financial applications and steal sensitive user data. Once installed, the malware can behave like a standard application to avoid detection. It has the capability to recognize banking apps on a device and present fraudulent login screens to intercept credentials.

While Google has removed the application from its store, experts warn that simply uninstalling the app may not be sufficient to ensure a device is clean. The specific number of infected devices has not been disclosed, and it remains unclear which specific banks or geographic regions were the primary targets of this latest campaign.