An Android Banking Malware Active in the Google Play Store

Topic

New Reply

https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-campaigns-android-banking-malware-active-google

..Recently, we noticed an increase in instances of the Anatsa malware (a.k.a. TeaBot). This sophisticated malware employs dropper applications that appear benign to users, deceiving them into unwittingly installing the malicious payload. Once installed, Anatsa exfiltrates sensitive banking credentials and financial information from global financial applications. It achieves this through the use of overlay and accessibility techniques, allowing it to intercept and collect data discreetly…

1 user thanked author for this post.

NaNoNyMouse

Reply | Quote

Replies

The malware comes as a 3rd party PDF/QR reader/file manager and uses a fake banking app front end that accepts your login credentials.

Bottom line: be careful what 3rd party apps you load on your phone.

cheers, Paul

3 users thanked author for this post.

NaNoNyMouse, Fred, Alex5723

Reply | Quote

Paul T wrote:

Bottom line: be careful what 3rd party apps you load on your phone.

Right you are….
Are the playstores for the apps losing their grip in what’s wrong?
Is there a way to check these “apps” yourself?.

* _ ... _ *

Reply | Quote

The apps in the store are OK, the malware comes via an “update”.

cheers, Paul

1 user thanked author for this post.

Fred

Reply | Quote

Paul T wrote:

The apps in the store are OK, the malware comes via an “update”.

And therein lies the problem.

I recently experienced a situation where an app I’d been using for years was updated and it suddenly said it now needed to access basically everything on my phone in order to work; which is a very bad thing!

I checked and found the “updated” version had the same app ID as the original but was from a completely different source (I “assume” because the original owner was enticed to sell it.)

Needless to say, I removed it and installed a different app that provided most of the original app’s functionality; at least the parts I used.

A few days latter, I found out Google had removed the original app from their store because was scraping data from users phones and sending it to a 3rd party!

Reply | Quote

Can you give the name of the “app” so if we are using it we can be careful?

 

Reply | Quote

This happened well over a year ago and I honestly don’t remember what it was called?

It was a clock widget that replaced the “default clock” with a bunch of different styles, some of which included the local weather conditions (temp & humidity) or the local forecast for the next week, depending on which clock style you chose.

I liked it because the time/weather info displayed without having to do anything other that just activate the phone screen.

The first clue that it’d been infected was when, after the update, it suddenly indicated it suddenly needed access to a lot of other apps on my phone (contacts, email, SMS, browser, etc. etc.) in addition to the original location only info!

Reply | Quote

n0ads wrote:

A few days latter, I found out Google had removed the original app from their store because was scraping data from users phones and sending it to a 3rd party!

Google want exclusive rights to scrap users data and sell to 3rd parties.

Reply | Quote