Moreover, these apps indeed possess the claimed functionality, after installation they do operate normally and further convince victim in their legitimacy,” the researchers noted.Īdditionally, there were dropper installations from Alien (95,000+) and Hydra/Ermac (15,000+) malware families too. The number of installations and the presence of reviews may convince Android users to install the app. There are large numbers of positive reviews for the apps. “Actors behind it took care in making their apps look legitimate and useful. One dropper app was installed more than 50,000 times, with the combined total of installations of all droppers reaching more than 100,000 installations. These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps. In total, ThreatFabric analysts were able to identify 6 Anatsa droppers published in Google Play since June 2021. The first dropper was discovered in June 2021 masquerading as an app for scanning documents. It can also perform classic overlay attacks in order to steal credentials, accessibility logging (capturing everything shown on the user’s screen), and keylogging. It is a rather advanced Android banking trojan with RAT and semi-ATS capabilities. Anatsa was discovered by ThreatFabric in January 2021.

Android worm virus