Over 90 malicious Android apps with 5.5M installs found on Google Play

Over 90 malicious Android apps — including recent Google Play dropper apps for the Anatsa (Teabot) banking trojan — were discovered, collectively installed some 5.5 million times; Anatsa uses a four-stage DEX-based loader with anti-analysis checks to fetch and install the banking payload, exfiltrate app and device data to C2, and download region-appropriate injection modules to steal credentials and conduct fraud. The two identified Anatsa dropper apps had about 70,000 installs before removal, highlighting active distribution via official app stores and significant risk to users' financial accounts.