Anatsa

Anatsa, a sophisticated Android banking trojan, is a malware designed to exploit and damage your device while stealing user financial data. It often masquerades as an innocuous file-management app to trick users into downloading it. Once installed, Anatsa downloads a target list of financial apps from the command-and-control (C2) server and checks if these apps are installed on the device. It then requests various permissions, including SMS and accessibility options, and establishes communication with the C2 server to carry out activities such as registering the infected device and retrieving a list of targeted applications for code injections. The malware utilizes a multi-stage approach to infect Android devices. Initially, it uses remote payloads retrieved from C2 servers to carry out further malicious activity. The droppers on Google Play deliver Anatsa onto Android devices in stages, contributing to relatively high infection rates. In addition, two specific Anatsa payloads were observed being distributed via apps impersonating PDF and QR-code reader applications. This strategic approach allows the malware to be uploaded to the official Google Play Store and evade detection. Despite Google's efforts to block malicious apps, Anatsa employs an attack vector that can bypass these protections. The malware, which can extract data from more than 650 financial apps, initially targeted Android users in Europe but has expanded its focus to include banking apps in the US and UK. Zscaler's analysis revealed that tools like those behind Anatsa are the most commonly used to hide malware on the mobile app store, followed by personalization and photography apps. Other impactful malwares currently being distributed on Google Play include Joker fleeceware, the credential-stealing Facestealer, and various types of adware.