Fake Document Reader On Google Play With 10K Downloads Installing Anatsa Malware

A malicious Android app masquerading as a file/document reader on Google Play distributed the Anatsa banking trojan, achieving over 10,000 installs before removal; the report details the two-stage dropper delivery, accessibility- and SMS-based credential theft, obfuscation/evasion techniques (runtime DEX, corrupted ZIP, emulation checks), targeted banking and crypto platforms, C2 infrastructure and IOCs, and recommends uninstalling the app, reviewing permissions, and scanning affected devices.