Google Play removes malicious PDF Reader app containing Anatsa trojan

Security researchers from Zscaler ThreatLabz have identified a malicious Android application named “PDF Reader” that was distributed through the official Google Play Store. The app, developed by Duka Zuri, was marketed as an office tool capable of opening and managing local PDF files, including password-protected documents.

Before its removal by Google, the application had been installed on more than 10,000 devices. The malware operates by initially performing its advertised functions to avoid detection, including identifying if it is running on a virtual testing environment. Once active, it downloads the “Anatsa” banking trojan from a remote server under the guise of a standard update.

The trojan exploits Android Accessibility Services to gain extensive permissions, allowing it to record logins and create deceptive banking interfaces to steal credentials. Experts advise users who may have installed the app to immediately uninstall it, change their banking credentials, and monitor their accounts for suspicious activity.