Anatsa malware targeting European Android users via apps on Google Play app store
There's a banking trojan targetting European Android users, and it uses a secure vector for deployment.
Anatsa is a piece of malicious code that infects Android smartphones and targets banking applications to steal a user's banking info. It was first noticed in early 2023 but seemed to fall by the wayside. Now, a new report claims that the malware resurfaced in November 2023 via otherwise normal Android apps.
The latest deployment campaign targeted European users in Slovakia, the Czech Republic, and the surrounding region, according to Threat Fabric. This is in addition to last year's wave of infections that targeted the United Kingdom, Spain, and Germany.
In this latest spread, the virus is deployed via seemingly innocuous apps available on the Google Play app store. Specifically, the trojan was found in the following apps (list via Bleeping Comptuer):
- Phone Cleaner - File Explorer (com.volabs.androidcleaner)
- PDF Viewer - File Explorer (com.xolab.fileexplorer)
- PDF Reader - Viewer & Editor (com.jumbodub.fileexplorerpdfviewer)
- Phone Cleaner: File Explorer (com.appiclouds.phonecleaner)
- PDF Reader: File Manager (com.tragisoap.fileandpdfmanager)
As of press time, these apps are no longer present on Google Play.
As of today, Threat Fabric states the malware has infected over 100,000 devices. However, that number is expected to grow as new apps are deployed to carry the virus.
Per Threat Fabric, Anatsa has the capability to fully control an infected device and "execute actions on a victim's behalf." In other words, the malware can take control of an installed banking app and execute transfers, withdrawals, and wires, all in the background and without the user's knowledge.
Android users, especially those in Europe, are urged to check their bank transaction records for any potentially fraudulent activity and report it to their financial institution immediately. They are also advised to review app permissions (specifically accessibility services) and to never download or install unknown or suspicious applications.
Source(s)
