Recently, Google Play removed five malicious apps that had amassed tens of thousands of downloads after a research firm alerted them to the threat. These apps were found to contain the Anatsa banking trojan and were targeting users in the UK, Czech Republic, Germany, Slovakia, Slovenia, and Spain. Originally focused on Samsung users, they later expanded to target devices from other manufacturers.

The research company ThreatFabric was the first to report on the resurgence of Anatsa and revealed the names of these phony apps:

– Phone Cleaner – File Explorer
– PDF Viewer – File Explorer
– PDF Reader – Viewer & Editor
– Phone Cleaner: File Explorer
– PDF Reader: File Manager

These fake apps were cleverly disguised as PDF and cleaner apps in an attempt to reach the Top New Free charts and increase their chances of being downloaded by unsuspecting users. It is estimated that these apps were downloaded between 150,000 and 200,000 times before being removed from the Play Store.

The Anatsa trojan is particularly dangerous as it has Device Takeover (DTO) capabilities, meaning it can take over an infected device and perform actions on your behalf. This includes stealing sensitive information from your phone and initiating transactions without your knowledge.

Although these malicious apps have been removed from Google Play, if you already have them on your phone, it’s crucial that you delete them immediately. To prevent falling victim to similar threats in the future:

– Always do a thorough check before downloading any app.
– Ensure that the app comes from a trusted developer.
– Pay close attention to requested permissions, especially those related to Accessibility Service.

By staying vigilant and mindful of these tips, you can protect yourself from falling prey to harmful apps like these in the future.