This nasty new Android malware can easily bypass Google Play security — and it’s already been downloaded thousands of times
Google forced to remove banking trojan-laden apps from its store
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers managed to sneakmalwaredroppers into theGoogle Play Store, infecting more than 100,000 people with banking trojans, security researchers have warned.
Cybersecurity experts from Threat Fabric recently warned of five separate campaigns, all targeting users in Europe - namely the UK, Germany, Spain, Slovakia, Slovenia, and the Czech Republic.
All campaigns have one thing in common - they use malware droppers hidden in Android apps that made it into the Google Play Store. These droppers then deploy the Anatsa banking trojan to the victims.
Reaching Top New Free
The researchers identified five malicious apps, mostly utility applications which, on the surface, work as intended. Those include Phone Cleaner - File Explorer, PDF Viewer - File Explorer, PDF Reader - Viewer & Editor, Phone Cleaner: File Explorer, and PDF Reader: File Manager.
In total, at least 130,000 people downloaded these apps, although the researchers claim 200,000 victims is a more likely number.
To look authentic and credible, the unnamed threat actors were aiming to reach the “Top New Free” category on Google Play. They focused on specific geographic regions and dropper apps to achieve this status. The dropper apps also implement a multi-stage infection process and are fully capable of abusing Android’s Accessibility Service to work around the OS’ security measures.
The researchers are warning Android users to be extra careful, even when downloading apps from the Play Store. Even though Google’s mobile app repository is generally considered secure, every once in a while, a malicious app makes it past its defenses. For this particular case, Google already removed all the malicious apps and confirmed it toBleepingComputerin a statement.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
There are a couple of things Android users can do to remain secure, including keeping Google Play Protect on, or having an antivirus program installed. Furthermore, they should be wary when installing apps, keeping an eye on the number of downloads, as well as user reviews.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
