Anatsa Banking Trojan Expands to North America via Google Play Dropper Apps

The Anatsa (a.k.a. TeaBot) Android banking trojan has launched its first large-scale campaign in the United States and Canada, hiding inside a popular “Document Viewer – File Reader” app on Google Play.

The dropper accumulated roughly 90,000 installs in six weeks before Google removed it, providing attackers with a foothold to steal credentials, keylog sessions, and automate fraudulent transactions against a broadened list of North American financial apps.

ThreatFabric analysts say the campaign mirrors five earlier European waves, yet shows a sharper focus on U.S. institutions and improved evasion tactics, such as deceptive maintenance overlays that mask fraud in real-time.

Anatsa at a Glance

Attribute	Details
First seen	2020
Aliases	TeaBot, Toddler
Primary vector	Google Play droppers (PDF, QR, cleaner, file viewers)
Targets	650+ banking/finance apps worldwide
Capabilities	Credential overlays, Accessibility abuse, Keylogging, On-device fraud (DTO)

Anatsa’s operators periodically pause distribution, refine the code, and then return with region-specific waves that quickly accumulate tens of thousands of installs before being taken down.

Proven Five-Step Campaign Process

ThreatFabric’s long-term telemetry shows each wave follows a consistent, five-step pattern:

Developer profile creation on Google Play.
Legitimate utility app release (e.g., PDF reader) to build trust and reviews.
User-base growth to reach Google Charts’ Top-Free lists, boosting visibility.
Malicious update that silently side-loads Anatsa via an external payload.
Dynamic targeting—the trojan fetches an updated list of banking package names from its C2, enabling on-the-fly expansion.

This cyclic approach lets the gang bypass store vetting, exploit user ratings as social proof, and keep infections geographically tailored.

How the North-American Dropper Worked

The 2025 campaign’s dropper package com.stellarastra.maintainer.astracontrol_managerreadercleaner looked and behaved as a genuine file viewer until June 24. An update then added code that:

Requested AccessibilityService permission to automate taps.
Downloaded a second-stage DEX from the C2, loading the full Anatsa payload in memory.
Displayed a “Scheduled Maintenance” overlay whenever victims opened any targeted banking app—blocking calls to customer support while credentials were siphoned.

Timeline of the U.S.–Canada Wave

Date	Milestone
07 May 2025	App first published on Google Play
29 Jun 2025	Climbed to #4 in “Top Free – Tools” chart (US)
24-30 Jun 2025	Malicious update pushed; active distribution window
01 Jul 2025	Google removes app after ThreatFabric report

Rapid Growth of Anatsa Download Waves

The North-American dropper continues a multi-year pattern of explosive install counts that outpace store defenses.

Impacted Banking Apps and Fraud Techniques installed, Anatsa can:

Harvest credentials via WebView-based overlays that mimic sign-in pages.
Intercept SMS 2FA codes through granted accessibility hooks.
Perform full Device-Takeover Fraud (DTO)—initiating transfers directly from the victim’s handset to bypass behavioral analytics[6].

ThreatFabric observed an expanded target list of U.S. institutions, including tier-1 retail banks, credit unions, and investment apps, alongside Canadian banking brands.

Why Tools-Category Apps Dominate

Analysis by Zscaler shows “Tools” utilities account for 40% of droppers because they plausibly request powerful permissions (storage, accessibility) without raising suspicion.

Google Play’s Unresolved Malware Gap

Google’s policy requires any app asking for AccessibilityService to justify the need, yet Anatsa operators still bypass vetting by shipping clean version 1.0 and weaponizing the first update—a tactic that evades automated static analysis and most manual reviews[3]. Until store workflows verify runtime behavior and cross-check update diffs, high-download droppers will continue to pose a recurring threat vector.

Indicators of Compromise & Mitigation

IOC Highlights (July 2025 wave)

Malicious PDF update domain: `menusand.com`
C2 API endpoint: `185.215.113.31:85/api`
Package name: `com.stellarastra.readercleaner`

Recommended Actions for Enterprises

Block known IOCs at MDM and network layers.
Harden mobile apps with root/jailbreak detection, certificate pinning, and overlay protection.
Leverage Play Integrity API to spot modified or repackaged environments.
Deploy behavioral fraud analytics capable of detecting DTO patterns (e.g., anomalous device biometrics, impossible timing).
Educate customers: limit installs to trusted vendors, revoke unnecessary permissions, enable Play Protect scans.

Strategic Take-aways for Banks & Developers

Risk Driver	Strategic Response
Dropper stealth via staged updates	Continuous mobile-app telemetry, store-update diff scanning
Accessibility abuse for DTO	In-app detection of suspicious accessibility events; enforce step-up verification
Overlay credential theft	Implement secure keyboard frameworks and deep-link sign-in to thwart overlays
Geo-targeted target lists	Monitor for sudden spikes in fraud from specific mobile OS versions or locales
Store takedown lag	Maintain threat-intel feeds and warn users faster than official store actions

The latest Anatsa incursion into North America underscores the persistent gap between official-store defenses and agile malware operators.