In a disturbing revelation, cybersecurity researchers have uncovered more than 90 malicious apps lurking on the Google Play store, which have collectively been downloaded over 5.5 million times. Deceptive apps pretending to be tools, like PDF readers, QR code scanners and file managers have been quietly distributing types of malware including the well known Anatsa banking Trojan.
The malicious apps employ sophisticated techniques to evade detection by Google Play’s security measures. After installation these applications discreetly retrieve data, from servers masking them as innocent software upgrades. This sneaky method enables the software to enter users devices and conduct its operations without being noticed.
Anatsa Trojan Targets Banking Apps
Among the most dangerous threats discovered is the Anatsa banking Trojan, also known as Teabot. This malicious app specifically targets financial applications, using overlay and accessibility techniques to intercept and exfiltrate sensitive banking credentials and financial information. Anatsa has broadened its scope currently focusing on banking applications, in the United States, the United Kingdom and various European and Asian nations.
Other malicious apps found on Google Play include the Joker fleeceware, which secretly subscribes users to premium services, and the Facestealer malware, which steals login credentials. Among these apps adware, which aims to flood users with ads has also been found.
To shield themselves from dangers Android users are encouraged to be careful when downloading apps from reputable sources, like Google Play. Companies should put in place security steps like embracing a zero trust framework and informing staff about the dangers of downloading apps on work devices. By staying alert and implementing safeguards users can reduce the chances of being targeted by apps and protect their confidential data.
