A new fake document reader app found on the Google Play Store has been silently installing Anatsa, a powerful Android banking trojan, on thousands of user devices. <\/p>\n
The malicious application surpassed 10,000 downloads before Google removed it, putting a significant number of Android users at direct risk of financial fraud and credential theft.<\/p>\n Anatsa is not a new name in mobile security. The malware first surfaced in 2020 as an Android banking trojan built to steal credentials, record keystrokes, and perform fraudulent transactions on infected devices without user knowledge. <\/p>\n Over the years, it has grown into one of the most persistent mobile banking threats, with its latest variant now targeting more than 831 financial institutions globally, including newly added banks and cryptocurrency platforms in countries like Germany and South Korea.<\/p>\n Researchers at Zscaler ThreatLabz identified the malicious application<\/a> on the Google Play Store and published their findings on April 27, 2026. The app was disguised as a file reader under the package name\u00a0com.groundstation.informationcontrol.filestation_browsefiles_readdocs\u00a0and had surpassed 10,000 downloads before Google removed it from the platform. <\/p>\n This incident is yet another chapter in Anatsa\u2019s ongoing campaign, which has repeatedly used benign-looking utility apps to bypass app store defenses and reach real users at scale.<\/p>\n ThreatLabz discovered another fake document reader in the Google Play Store with more than 10K downloads, which delivered the Anatsa Android trojan.<\/p>\n Anatsa installer SHA256 hash: 5c9b09819b196970a867b1d459f9053da38a6a2721f21264324e0a8ffef01e20 \u2014 Zscaler ThreatLabz (@Threatlabz) April 27, 2026<\/a><\/p>\n The app used a dropper technique to stay undetected during the store\u2019s review process. Once installed, it appeared to work normally as a document reader, showing no signs of malicious activity<\/a>. <\/p>\n In the background, it connected to a remote server and pulled down the Anatsa payload from\u00a0http:\/\/23.251.108[.]10:8080\/privacy.txt, silently installing the trojan without any user-visible alerts. This two-stage delivery is designed to beat app store reviews that only assess apps at the point of submission.<\/p>\n This method of staying clean at first and then downloading malware later has been a signature of Anatsa\u2019s campaigns for years. <\/p>\n Since Google Play\u2019s security scans focus on the initial version of an app, the trojan can enter the platform undetected and wait until it has enough installations before activating. By that point, the malware is already running on thousands of real devices.<\/p>\n Infection Mechanism and Detection Evasion<\/p>\n Once Anatsa\u2019s payload is running on a device, it requests accessibility permissions from the user. If granted, the malware automatically activates a broader set of privileges, including overlaying content on top of other apps, intercepting SMS messages, and displaying full-screen alerts. <\/p>\n These capabilities are used to capture user activity, steal banking credentials, and interfere with legitimate app interactions without raising obvious alarms.<\/p>\n To stay hidden from security tools, Anatsa hides its DEX file inside a corrupted ZIP archive with invalid compression flags. The file only executes at runtime and is deleted immediately after loading, making it very difficult for static tools to catch. <\/p>\n The payload is further embedded inside a JSON file that is dropped and erased during execution, leaving minimal evidence of the infection on the device.<\/p>\n Anatsa encrypts all traffic to its command-and-control servers using a single-byte XOR key. In this campaign, the C2 servers were hosted at\u00a0http:\/\/172.86.91[.]94\/api\/,\u00a0http:\/\/193.24.123[.]18:85\/api\/, and\u00a0http:\/\/162.252.173[.]37:85\/api\/. <\/p>\n These servers deliver fake banking<\/a> login overlays that appear directly over legitimate banking apps, tricking users into entering their credentials on fraudulent pages that look completely real.<\/p>\n The malware also performs emulation checks and verifies the device model before deploying the payload. If it detects a sandboxed or testing environment, it simply displays a clean file manager interface instead of launching the trojan. <\/p>\n This built-in self-defense mechanism helps Anatsa<\/a> remain undetected during automated analysis, giving it more time to operate freely on real user devices without being flagged.<\/p>\n Android users should review the permissions any new app requests before approving them. Document readers and file managers have no legitimate reason to request accessibility permissions or SMS access. <\/p>\n Keeping Google Play Protect turned on, avoiding apps from unfamiliar developers, and questioning any app that asks for unusual permissions are all practical steps worth taking. <\/p>\n Anyone who installed the affected application should uninstall it immediately and scan their device with a trusted mobile security tool<\/a>.<\/p>\n Indicators of Compromise (IOCs):-<\/p>\n IndicatorTypeDetail5c9b09819b196970a867b1d459f9053da38a6a2721f21264324e0a8ffef01e20Installer SHA256Anatsa dropper hash88fd72ac0cdab37c74ce14901c5daf214bd54f64e0e68093526a0076df4e042fPayload SHA256Anatsa core payload hashhttp:\/\/23.251.108[.]10:8080\/privacy.txtPayload URLRemote payload delivery serverhttp:\/\/172.86.91[.]94\/api\/C2 ServerAnatsa command-and-controlhttp:\/\/193.24.123[.]18:85\/api\/C2 ServerAnatsa command-and-controlhttp:\/\/162.252.173[.]37:85\/api\/C2 ServerAnatsa command-and-controlcom.groundstation.informationcontrol.filestation_browsefiles_readdocsPackage NameMalicious dropper app (removed)<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/p>\n
Payload URL:\u2026 pic.twitter.com\/CBAgWfaa4n<\/a><\/p>\n