Anatsa Android Banking Trojan
Anatsa: Advanced Android Trojan Enabling Real-Time Banking Fraud Through Remote Access
Anatsa, also known as TeaBot, is a feature-rich Android banking Trojan that enables attackers to steal credentials, capture screen activity, log keystrokes, and remotely control infected devices. First discovered in late 2020, Anatsa has been used in high-volume fraud campaigns across Europe and North America, often distributed through fake apps posing as PDF readers, QR code scanners, or antivirus tools. Unlike older banking malware, Anatsa supports full device interaction, allowing fraudsters to initiate and complete unauthorized transactions in real time.
Introduction to Anatsa
Anatsa is part of the new wave of mobile malware with both spyware and RAT functionality, exploiting Android accessibility services to bypass protections in banking apps. It is designed to stay under the radar while providing attackers with deep access to victims’ devices. Once installed, it quickly begins stealing login credentials and session tokens, enabling automated and manual fraud via a backdoor channel.
1. How Anatsa Works
Infection Mechanism:
Anatsa spreads primarily via:
- Fake apps on the Google Play Store (PDF editors, scanners, file managers)
- Third-party app stores and malicious websites
- Dropper apps, which download Anatsa post-installation
- Users are tricked into enabling accessibility services and other risky permissions
Payload Execution:
Once active, Anatsa:
- Launches overlay attacks to steal banking credentials
- Records screen content and user input, including keystrokes
- Captures accessibility events to extract data from secure apps
- Provides full remote access for fraud operations
- Bypasses 2FA by intercepting SMS and push notifications
- Sends stolen data and session tokens to attackers' C2 servers
2. History and Notable Campaigns
Origin and Discovery:
Anatsa was first identified in late 2020 and has been continuously updated since. It was originally tracked by researchers from ThreatFabric, who flagged its use in highly coordinated banking fraud.
Notable Campaigns:
- In 2021–2023, Anatsa was used to target banking customers in Germany, the U.K., the U.S., Spain, Slovakia, and the Netherlands
- Apps delivering Anatsa have bypassed Google Play defenses multiple times
- Anatsa has been found embedded in apps downloaded over 100,000 times before removal
- Some campaigns used geofencing to activate the malware only in target regions
3. Targets and Impact
Targeted Victims and Sectors:
- Individual Android users, especially those using mobile banking apps
- Victims in Europe and North America
- Targets include users of retail banks, investment platforms, and crypto wallets
Consequences:
- Full account takeovers and wire fraud
- Theft of login credentials, PINs, and session data
- Loss of personal and financial information
- Attackers can remotely complete bank transfers using stolen credentials and RAT features
4. Technical Details
Payload Capabilities:
- Overlay attacks on financial apps
- Accessibility abuse for keystroke logging and UI interaction
- Screen recording, screenshot capture, and clipboard monitoring
- Full remote access to the infected device
- Theft of Google Authenticator and SMS-based 2FA
- Uses ATS (Automated Transfer System) modules for in-app fraud execution
Evasion Techniques:
- Delivered through clean-looking dropper apps
- Activates malicious behavior only after delayed triggers or specific conditions
- Frequently updated with new encryption and C2 channels
- Uses code obfuscation and anti-emulation checks to avoid detection in sandboxes
5. Preventing Anatsa Infections
Best Practices:
- Only install apps from official sources and verify developer names
- Avoid granting accessibility and overlay permissions to unknown apps
- Use device security policies in enterprise settings to block unverified installs
- Keep the Android OS and all apps up to date
- Educate users about fake app risks and phishing tactics
Recommended Security Tools:
- Google Play Protect with real-time scanning
- Mobile antivirus apps with behavior-based detection (e.g., Bitdefender, Norton, Kaspersky)
- Mobile Threat Defense (MTD) platforms for enterprise users
- Banking apps that use biometric authentication and real-time fraud monitoring
6. Detecting and Removing Anatsa
Indicators of Compromise (IoCs):
- Presence of unfamiliar apps with access to accessibility or notification settings
- Abnormal battery drain or hidden data usage
- Unexplained app overlays or duplicate login screens
- SMS and app notifications being silently intercepted or cleared
- New device activity or unknown logins in banking accounts
Removal Steps:
- Revoke suspicious apps' accessibility permissions
- Use a trusted mobile malware scanner to identify and remove Anatsa
- Perform a factory reset if infection persists
- Change all affected banking and email passwords
- Notify your financial institution to flag or freeze suspicious activity
Professional Help:
Users experiencing financial loss or coordinated fraud should contact their bank’s fraud team and, if applicable, seek support from incident response teams or cybersecurity specialists.
7. Response to an Anatsa Infection
Immediate Steps:
- Disconnect the infected device from the internet
- Notify the affected bank(s) and change credentials from a secure device
- Uninstall suspicious apps and reset the device if necessary
- Monitor financial accounts and credit activity
- Consider replacing the device if root-level compromise is suspected
8. Legal and Ethical Implications
Legal Considerations:
Anatsa is used in serious financial crimes, and those who deploy it or distribute it knowingly are liable under international cybercrime laws. Victims may be subject to fraud reporting requirements under regulations like GDPR or PCI DSS.
Ethical Considerations:
Anatsa represents the dark evolution of mobile malware into fully automated fraud tools. It exploits user trust in apps and accessibility services—features meant to improve usability—to commit targeted theft, violating privacy and financial autonomy.
9. Resources and References
- ThreatFabric: Anatsa Technical Report
- Mobile ID World: Anatsa Banking Trojan Infects 220,000 Android Users Through Fake File Manager App
- Cleafy: Android Threat Updates
- MITRE ATT&CK for Mobile:
10. FAQs about Anatsa
Q: What is Anatsa malware?
Anatsa is an Android banking Trojan that uses overlay attacks, accessibility abuse, and remote access to steal credentials and perform fraud.
Q: How does Anatsa spread?
Through fake apps disguised as utilities or security tools, often uploaded to the Google Play Store or distributed via phishing links.
Q: Can it bypass two-factor authentication?
Yes — it can intercept OTPs via SMS, push notifications, and screenshot Google Authenticator codes.
Q: How do I remove it?
Revoke app permissions, uninstall suspicious apps, and run a trusted mobile malware scanner. A factory reset is recommended for full cleanup.
11. Conclusion
Anatsa is among the most dangerous Android banking Trojans in circulation, blending credential theft with real-time remote fraud capabilities. As financial apps continue to dominate mobile platforms, threats like Anatsa show how critical it is to combine strong mobile security with user awareness and app vetting. Its sophistication and reach make it a top concern for users and institutions alike.
« Back to the Virus Information Library