October 29, 2026, 2:47 pm | Read time: 4 minutes
An initially inconspicuous Android app from the official Google Play Store can pose a threat to bank customers. The download offered as “PDF Reader” eventually downloads the Anatsa banking trojan. This can capture login credentials and SMS messages. More than 10,000 installations were registered before Google removed the app.
PDF Reader Downloads Anatsa Banking Trojan
Security researchers from Zscaler ThreatLabz discovered the “PDF Reader” app by developer Duka Zuri in the Google Play Store. The application was installed more than 10,000 times. It is unknown how many devices were actually infected.
The app initially fulfills its promised function as a PDF reader or file manager and behaves inconspicuously. If it detects that it is running in a test environment, meaning an environment where the application is being examined by security experts, it initially does not activate its malicious function. Only after some time does the app download the actual Anatsa malware, disguising the process as a regular update. This approach makes the malware so dangerous.
Malware Gains Access to Sensitive Data
Anatsa then requests access to Android accessibility features. These functions are intended to make smartphone use easier for people with visual, hearing, motor, or cognitive impairments. Through the granted permission, the trojan can gain further access capabilities.
This allows the malware to read SMS messages and overlay windows on other apps. For example, fake login screens can be placed over real banking apps. In addition to usernames and passwords, the malware can also intercept SMS confirmation codes this way.
Anatsa is also known as TeaBot and has been distributed via the Play Store with various decoy apps and developer accounts since at least 2020. A previous wave of attacks targeted more than 650 financial institutions. Now, it targets more than 830, including targets in Germany and South Korea, as well as crypto platforms.
Warning: Nearly 150,000 Android Smartphones Infected with Banking Trojan
Millions of Devices at Risk: New Trojan Monitors Smartphones
Hirudo Can Replace Banking App with Manipulated Version
In parallel, another Android malware called Hirudo has become known. It disguises itself as a shopping, entertainment, or short video app. Security researchers from ThreatFabric have so far discovered manipulated copies of eight banking applications.
Hirudo initially prompts the user to grant certain access rights, including access to accessibility features. Once the malware has these permissions, it can remove the real banking app from the smartphone, download and install a manipulated version. In doing so, Hirudo can bypass various security checks.
The manipulated app largely resembles the original. Attackers can capture bank passwords, payment and device PINs, SMS messages, and screen content. The camera and microphone can also be misused. Fake payment pages show a successful completion after data entry.
ThreatFabric initially observed Hirudo with banking apps from Indonesia. There are also indications of attacks against financial organizations in China, India, Mexico, Morocco, and Thailand. The number of affected individuals is unknown but is said to be in the thousands.
Also of interest: How risky is online banking on a smartphone
How Android Users Should React to Suspected Malware
Google has removed the apps identified as harmful from the Play Store. Anyone who has already installed the affected PDF Reader must uninstall it themselves and should then scan the device with an up-to-date antivirus program. Google Play Protect also offers some protection but cannot always detect malware.
If a suspicious app cannot be removed regularly, the BSI recommends restarting in safe mode. Android only loads native system functions there, allowing the affected application to be uninstalled via settings. If that also fails, the device can be reset to factory settings.
Resetting will result in the loss of personal data and settings, so regular data backups are important. After removing the trojan, access credentials should be changed. Anyone who has used banking apps on a potentially infected device should also contact their bank.
Android users should only install apps from official sources, not open APK files from unknown stores, keep devices up to date, and regularly run Play Protect. USB debugging via developer options should only be used by technically savvy users, as enabling it can further increase security risks.