Cyber Press<\/a>.\n<\/p>\n\n The news platform said: “When a user downloads the fake document reader, the application functions normally at first, displaying the expected user interface to avoid suspicion.\n<\/p>\n
\n “However, in the background, the application quietly connects to a remote server to download the secondary malicious payload.\n<\/p>\n
\n “Once the Anatsa payload is installed on the victim\u2019s device, it immediately requests sweeping permissions, particularly targeting Android\u2019s Accessibility Services.”\n<\/p>\n
\n By gaining access to these privileges, the malware can:\n<\/p>\n
Observe the user\u2019s screen<\/p>\n
Capture keystrokes<\/p>\n
Interact with the device\u2019s interface<\/p>\n
\n The primary objective of the Anatsa Trojan is to monitor banking and financial apps.\n<\/p>\n
\n Cyber Press continues: “When a victim attempts to log in to a targeted banking app, Anatsa intercepts the process and displays a fake overlay that perfectly mimics the legitimate login page.\n<\/p>\n
\n “Unsuspecting users enter their credentials into this fraudulent form, directly handing their usernames, passwords, and two-factor authentication codes to the attackers.”\n<\/p>\n
\n The malware can also gain access to SMS messages and\u00a0approve transaction prompts.\n<\/p>\n
Check for suspicious apps to avoid the Anatsa Trojan<\/p>\n
\n Android users who have downloaded any suspicious\u00a0document readers recently should “immediately review their installed applications and monitor their bank statements for unauthorized activity”.\n<\/p>\n
\n Have you downloaded any suspicious apps recently? Let us know in the comments below.\n<\/p>\n