Google: Google removes trojan-laden Android apps from Play Store: How they affected users – Times of India

An Android trojan malware named ‘Anatsa’ has been attacking smartphone users in multiple countries including — the US, the UK, Germany, Austria and Switzerland. According to a report by BleepingCompouter, analysts at ThreatFabric have discovered a new ‘Anatsa’ campaign that started last March where the trojan malware was targeting online banking customers in these countries.
Trojan malware uses apps that hide their real intentions which comes to light once users install these apps. The report claims that an app listed in the Google Play Store was impersonating a PDF reader, which when installed downloaded the trojan payload. The payload which was loaded from GitHub, was also disguised as an add-on to the original app.
Google has announced that it has identified the malicious apps and has removed them from Play Store. The tech giant has banned the developers and has added that Google Play Protect automatically removes such apps that contain this malware on Android devices with Google Play Services.
Earlier, in November 2021, ThreatFabric’s analysts also tracked other campaigns that used apps located in the Google Play Store to deliver the Anatsa banking trojan. These apps impersonated PDF scanners, QR code scanners, Adobe Illustrator apps and fitness tracker apps and had over 30,000 installations. The motive of this malware is to steal the credentials used by customers on banking apps and initiate fraudulent transactions by performing Device-Takeover (DTO) Fraud.
How the latest ‘Anatsa’ campaign worked
After Google removed the Anatsa-carrying app from Play Store, the attackers added another app to the Android app marketplace. This time the app was disguised as a PDF viewer app which was also downloading the payload disguised as an add-on for the app.
Google removed these apps from the Play Store whenever they were reported, and the attackers promptly uploaded a new dropper under a new disguise. The five apps that dropped the malware were submitted to Google Play in a clean form and were later updated with malicious code in order to evade Google’s strict code review process on the first submission.

Anatsa collects financial information like bank account credentials, credit card details, payment information, etc. The trojan overlays phishing pages in the foreground when the user attempts to launch their legitimate bank app and also via keylogging. The latest Anatsa trojan campaign affected nearly 600 financial apps of banking institutions from across the world.
“Since transactions are initiated from the same device that targeted bank customers regularly use, it has been reported that it is very challenging for banking anti-fraud systems to detect it,” explains ThreatFabric.
The stolen amounts are then converted to cryptocurrency and passed through an extensive network of money mules in the targeted countries. The network members then keep a portion of the stolen funds as a revenue share and send the rest to the attackers.