The Anatsa banking trojan has been targeting users in Europe by infecting Android devices through malware droppers hosted on Google Play.

The five malicious apps are:

  1. Phone Cleaner - File Explorer (com.volabs.androidcleaner)
  2. PDF Viewer - File Explorer (com.xolab.fileexplorer)
  3. PDF Reader - Viewer & Editor (com.jumbodub.fileexplorerpdfviewer)
  4. Phone Cleaner: File Explorer (com.appiclouds.phonecleaner)
  5. PDF Reader: File Manager (com.tragisoap.fileandpdfmanager)
  • IllNess@infosec.pub
    ·
    9 months ago

    Here's the worst part:

    At the time of writing, Google removed all Anatsa dropper apps from the official Android store except for the PDF Reader, which continues to be available.

    I no longer see the app. At least Google is doing something.