Five malware-filled apps have been advised to be deleted by Android users, and owners of Samsung Galaxy devices should be especially cautious.
The applications downloaded from the Google Play Store, conceal a particularly nasty bug called Anatsa, a banking trojan.
Without the victim’s knowledge, this trojan virus can carry out tasks on their behalf, including withdrawing money from your bank account.
Experts at Threat Fabric, a security company, said the apps pose a ‘critical’ threat to Android users – and more specifically, those with Samsung Galaxy phones.
‘A unique aspect of this dropper was its malicious code, specifically targeting Samsung devices,’ the company said in a statement.
‘The malicious AccessibilityService was tailored to interact with the UI [user interface] elements of Samsung devices, meaning only Samsung users were impacted in this phase of the campaign.
Delete these five apps now
- Phone Cleaner – File Explorer
- PDF Viewer – File Explorer
- PDF Reader – Viewer & Editor (com.jumbodub.fileexplorerpdfviewer)
- Phone Cleaner: File Explorer
- PDF Reader: File Manager
‘This suggests that the threat actors initially developed and tested their code exclusively for Samsung devices.’
The apps have now been removed from the store, but the security team have said even if you have downloaded them, you could still be at risk, and urge Android users to check their devices now.
A Google Spokesperson said: ‘All of the apps identified in the report have been removed from Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.
‘Google Play Protect can warn users or block apps known to exhibit malicious behaviour, even when those apps come from sources outside of Play.’
Anasta came into the spotlight in 2023, but has been seen since 2021.
‘Over the past four months, we have observed five distinct waves of this campaign, each focusing on different regions,’ the team said.
However, it doesn’t expect the virus to die out anytime soon, and said: ‘Based on this pattern, we anticipate the continuation of this campaign, with new droppers appearing in the official store and an expansion into additional targeted regions.’
Users are advised to protect their phones by being careful which permissions they allow on their device, and to delete apps that aren’t used unless they trust the developer.
