Cleanova

Google Play Apps Hide Anatsa Banking Trojan Using Stealthy Loaders

Malicious applications distributed through Google Play are employing stealthy loaders to install the Anatsa banking trojan for Android, putting victims' financial accounts at risk. The campaign relies on seemingly legitimate programs to conceal the initial infection stage, with one identified case involving a modified PDF reader that displays a fake update prompt to trick users into installing an additional component. Another loader discovered in the Cleanova application collects data from analytics SDKs, including installation source details, and forwards this information to a command-and-control server. The server then decides whether to deliver the malicious payload based on predefined criteria, leaving the code inactive for non-targeted victims to evade automated analysis. Once Anatsa is installed, the threat can facilitate theft of credentials used for financial services and enable fraudulent transactions. Banking trojans represented 30.77 percent of detected malicious mobile applications in the second quarter of 2026, during which more than 1.99 million attacks involving malware, adware, or unwanted programs were blocked and 93,574 banking trojan installation packages were identified.

Android Banking Trojans Hide in Droppers to Bypass Google Play Checks

Kaspersky solutions blocked 1.99 million attacks involving Android malware, adware and potentially unwanted programs in the second quarter of 2026, down from 2.68 million the previous quarter. Researchers still recorded 304,000 malicious installation packages, among them 93,600 banking trojans that retained the largest share at 30.77 percent. Operators increasingly rely on droppers that pass initial store review and later download the real payload. One PDF reader application distributed through Google Play displayed a fake update prompt that installed the Anatsa banking trojan. The Cleanova dropper collected installation-source data and delivered its payload only under attacker-chosen conditions, avoiding analysis environments. The share of users hit by Trojan-Dropper.AndroidOS.Banker.dd rose sharply from 0.01 percent to 2.16 percent, while the Mamont and Creduz families continued to expand with new variants.