# Anatsa banking malware on Android

> Developing situation record from CLSTR: https://clstr.news/situations/anatsa-banking-malware-on-android
> Updated: 2026-10-29T11:40:58.000Z. Sources: 2. Developments: 2.

Security researchers from Zscaler ThreatLabz identified a malicious Android application distributed via the Google Play Store that disguised itself as a legitimate PDF reader. Developed by Duka Zuri, the app was marketed as an office tool for managing local and password-protected PDF files.

The application served as an installer for the Anatsa banking trojan, also known as TeaBot. To avoid detection, the app initially performed its advertised functions and checked for virtual testing environments. Once active, it would download the malware from a remote server under the guise of a standard update.

Anatsa exploits Android Accessibility Services to gain extensive permissions, allowing it to record logins and present fraudulent interfaces to intercept banking credentials. Before its removal by Google, the application had been installed on more than 10,000 devices. Experts advise users to uninstall the app, change banking credentials, and monitor accounts for suspicious activity.

## Timeline

### 2026-10-29: Google Play removes malicious PDF Reader app containing Anatsa trojan

A fake “PDF Reader” app on Google Play, which reached over 10,000 downloads, has been removed for distributing the Anatsa banking trojan to steal user credentials.

2 sources. https://clstr.news/cluster/google-play-removes-malicious-pdf-reader-app-containing-anatsa-trojan

### 2026-10-18: Android malware Anatsa found in fake PDF reader app

A fake PDF reader app on the Google Play Store with over 10,000 installs has been identified as a distributor for the Anatsa (TeaBot) banking malware targeting Android users.

3 sources. https://clstr.news/cluster/android-malware-anatsa-found-in-fake-pdf-reader-app

---
Cite as: Anatsa banking malware on Android. CLSTR, https://clstr.news/situations/anatsa-banking-malware-on-android