Malicious PDF Reader App on Android Spreads Anatsa Banking Malware

Android PDF Reader App Hides Anatsa Malware Targeting Banking Apps

Android users face a security problem after cyber intelligence researchers discovered a malicious PDF reader application hiding a malware that can attack banking applications on the Google Play Store, according to a report by tn.nova.cz. The fraudulent app, which successfully masqueraded as a legitimate document viewer, accumulated over 10,000 downloads before security teams flagged its malicious payload.

The rogue software introduces a sophisticated installer capable of infiltrating secure mobile environments to steal sensitive personal data and compromise financial applications. Google has already removed the offending program from its official marketplace, but security analysts warn that thousands of devices may still harbor the infection because standard uninstallation methods often fail to scrub residual files.

ThreatLabz Discovery Triggers Urgent Play Store Removal

Threat intelligence researchers at ThreatLabz first uncovered the active campaign, alerting the public via social media regarding the malicious distribution vector. “We discovered a new installer of the Anatsa malware spreading via the Google Play Store offering,” the team announced on X. The application successfully evaded initial detection by maintaining full functionality as a standard PDF reader immediately following installation, leaving victims completely unaware of the background infection.

The malicious software is officially tracked under the package name com.railforge.footplate.documentreader_pdfviewer. While the exact geographic regions and banking institutions targeted by this specific campaign remain unconfirmed, security experts emphasize that users in the Czech Republic and across Europe cannot be ruled out as targets for the financial theft operation.

Anatsa Trojan Characteristics and Removal Procedures

The Anatsa malware—frequently identified by security researchers under its alternate moniker, TeaBot—operates as a stealthy Android banking Trojan designed to harvest user credentials and manipulate device sessions. Because the malicious payload integrates deeply into the system upon installation, simply dragging the icon to the trash or utilizing standard app removal features does not guarantee complete eradication.

Affected users must immediately verify their device application lists against the specific package name identified by ThreatLabz. If the offending document reader is present, individuals must delete the software and immediately execute a comprehensive device scan utilizing Google Play Protect to ensure no malicious persistence mechanisms remain active on the mobile operating system.

More on Android: Four legacy Android brands continue manufacturing specialized devices