Anatsa Banking Trojan Targets North American Users Through Google Play App
Summary
ThreatFabric reports that an Anatsa campaign targeted North American banking users via a Google Play file-reader app. The app was updated with a malicious payload and used deceptive overlays to conceal fraudulent activity.
Key points
- ThreatFabric identified at least the third Anatsa campaign targeting mobile banking customers in the United States and Canada.
- A file-reader dropper app initially appeared legitimate, then received a malicious update about six weeks after release.
- The app, promoted as a “PDF Update,” reached more than 50,000 downloads and ranked among the top three free tools on the US Google Play Store before removal.
- The campaign’s distribution window ran from 24 to 30 June.
- Anatsa can steal credentials through overlays and keylogging, and use remote control to carry out fraudulent transactions.
- A “Scheduled Maintenance” overlay was displayed when users opened targeted banking apps, masking activity and discouraging contact with bank support.
Article Details
- Attack Vectors
- A legitimate-looking file reader app was distributed through the official Google Play Store and later updated to embed malicious code.
- The dropper downloaded and installed Anatsa as a separate application, with the payload presented as a “PDF Update.”
- Anatsa used deceptive overlays and keylogging to steal banking credentials, and remote control to perform fraudulent transactions.
- Defensive Notes
- Financial-sector organizations are encouraged to assess potential risks to their customers and systems.
- The article reports that the dropper app was removed from Google Play.
MITRE ATT&CK
T1407The dropper downloaded and installed Anatsa as a separate application.T1411Anatsa displayed deceptive overlays when users accessed banking applications.T1417.001Anatsa used keylogging to steal credentials.T1475The dropper app was distributed through the official Google Play Store.T1476A legitimate-looking file reader app on Google Play was later updated to include malicious code.T1623Anatsa used remote control functionality to carry out fraudulent transactions on infected devices.