MalwarePublished 25 Aug 2025

Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware

Source Reddit InfoSec News

Description

Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware Source: https://securityaffairs.com/181528/malware/malicious-apps-with-19m-installs-removed-from-google-play-because-spreading-anatsa-banking-trojan-and-other-malware.html

Impact

For European organizations, the impact of this threat is multifaceted. Employees using Android devices for work or personal banking could have their credentials stolen, leading to unauthorized access to corporate financial accounts or personal accounts that could be leveraged for social engineering attacks. The theft of two-factor authentication tokens further exacerbates the risk by bypassing an important security layer. Financial losses could occur both directly through fraudulent transactions and indirectly through remediation costs, reputational damage, and regulatory penalties under GDPR if personal data is compromised. Additionally, compromised devices could serve as entry points for lateral movement within corporate networks if connected to enterprise resources. The threat also undermines trust in mobile applications and app marketplaces, potentially affecting mobile banking adoption and digital transformation initiatives within European financial institutions.

Defensive guidance

European organizations should implement a multi-layered defense strategy. First, enforce strict mobile device management (MDM) policies that restrict installation of apps to trusted sources and whitelist approved applications. Employ mobile threat defense (MTD) solutions capable of detecting and blocking known banking trojans like Anatsa. Educate employees about the risks of installing apps from unofficial sources and the importance of scrutinizing app permissions. Encourage the use of hardware-based or app-based multi-factor authentication methods that are resistant to interception by malware. Regularly monitor network traffic for anomalous behavior indicative of data exfiltration from mobile devices. Collaborate with financial institutions to establish rapid response protocols for suspected credential compromise. Finally, advocate for enhanced app vetting processes with platform providers and report suspicious apps promptly to reduce exposure.

Summary

This threat involves a set of malicious Android applications that were available on the Google Play Store and collectively amassed over 19 million installs before being removed. These apps were distributing the Anatsa banking trojan along with other malware variants. Anatsa is a sophisticated banking trojan primarily targeting Android devices, designed to steal sensitive financial information such as banking credentials, credit card details, and two-factor authentication tokens. It achieves this by overlaying fake login screens on legitimate banking apps, intercepting SMS messages, and capturing keystrokes. The malware often gains extensive permissions on infected devices, enabling it to monitor user activity and exfiltrate data stealthily. The presence of these apps on the official Google Play Store indicates that the attackers employed advanced evasion techniques to bypass Google's security vetting processes, such as using obfuscation, delayed activation of malicious payloads, or dynamic code loading. Although the apps have been removed, the widespread installation base suggests a significant number of potentially compromised devices remain active. The lack of known exploits in the wild beyond these apps implies that the threat is primarily through user installation rather than remote exploitation. The minimal discussion on Reddit and the medium severity rating suggest that while the threat is serious, it may not be currently widespread or actively exploited at scale beyond the initial infection vector.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Aug 2025, 21:03 UTC

Technical details

References

Community reviews

Related threats