Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage.
One identified case involves a modified PDF reader that displays a fake update prompt after launch, tricking users into installing an additional component that prepares the device to receive the banking malware. This approach allows the code initially published in the store to appear harmless during security checks, with malicious behavior activated only after the program reaches the device of a victim deemed interesting by the operators.
Another loader was found in the Cleanova application. It collects information provided by analytics SDKs, including data that can indicate the installation source, and sends these details to a command-and-control server. The server then decides whether to deliver the malicious payload. When the installation origin does not match the criteria set by the criminals, the code remains inactive, a technique that complicates identification during automated analysis processes.
If Anatsa is installed, the threat can support the theft of information used to access financial services and enable fraudulent operations. Banking trojans represented 30.77 percent of malicious applications detected in the second quarter of 2026. During that period, more than 1.99 million attacks involving malware, adware, or unwanted programs for mobile devices were blocked, and 93,574 installation packages related specifically to banking trojans were identified.
