This nasty new Android malware can easily bypass Google Play security — and it's already been downloaded thousands of times

(Image credit: Android Authority)

Hackers managed to sneak malware droppers into the Google Play Store, infecting more than 100,000 people with banking trojans, security researchers have warned.

Cybersecurity experts from Threat Fabric recently warned of five separate campaigns, all targeting users in Europe - namely the UK, Germany, Spain, Slovakia, Slovenia, and the Czech Republic.

All campaigns have one thing in common - they use malware droppers hidden in Android apps that made it into the Google Play Store. These droppers then deploy the Anatsa banking trojan to the victims.

Reaching Top New Free

The researchers identified five malicious apps, mostly utility applications which, on the surface, work as intended. Those include Phone Cleaner - File Explorer, PDF Viewer - File Explorer, PDF Reader - Viewer & Editor, Phone Cleaner: File Explorer, and PDF Reader: File Manager.

In total, at least 130,000 people downloaded these apps, although the researchers claim 200,000 victims is a more likely number.

To look authentic and credible, the unnamed threat actors were aiming to reach the “Top New Free” category on Google Play. They focused on specific geographic regions and dropper apps to achieve this status. The dropper apps also implement a multi-stage infection process and are fully capable of abusing Android’s Accessibility Service to work around the OS’ security measures.

The researchers are warning Android users to be extra careful, even when downloading apps from the Play Store. Even though Google’s mobile app repository is generally considered secure, every once in a while, a malicious app makes it past its defenses. For this particular case, Google already removed all the malicious apps and confirmed it to BleepingComputer in a statement.

There are a couple of things Android users can do to remain secure, including keeping Google Play Protect on, or having an antivirus program installed. Furthermore, they should be wary when installing apps, keeping an eye on the number of downloads, as well as user reviews.

More from TechRadar Pro

Malware removal on Android: how to clean up your smartphone
Here's a list of the best firewalls around today
These are the best endpoint security tools right now

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.