Loading story…
Two Android apps published on Google Play, Currency Converter and BatterySaverMobi, were found to function as droppers for the Anubis banking trojan. The apps used motion-sensor checks to detect whether they were running on a real device rather than in a sandbox or emulator, then fetched command-and-control details through encoded requests tied to Telegram and Twitter pages. After installation, they displayed a fake system update prompt designed to persuade users to sideload a malicious APK that delivered the Anubis payload.
Once deployed, Anubis was capable of targeting 377 financial app variants across 93 countries and stealing data through keylogging, screenshots, abuse of Android accessibility features, and broad device permissions. Researchers linked the activity to infrastructure including the domain aserogeege.space, and Google removed both malicious apps from the Play Store after the discovery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After the apps were discovered, Google removed Currency Converter and BatterySaverMobi from the Play Store. The apps were linked to Anubis infrastructure including the domain aserogeege.space, and the malware was described as targeting 377 financial app variants across 93 countries.
Researchers identified two Android apps on Google Play, Currency Converter and BatterySaverMobi, that acted as droppers for the Anubis banking malware. The apps used motion-sensor-based anti-analysis checks, fetched command-and-control details via encoded Telegram and Twitter requests, and tried to trick users into installing a fake system update APK.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026
A malicious Android app posing as a document reader on the official Google Play Store delivered the **Anatsa** banking trojan to more than **10,000 users** before removal. Researchers said the app used a dropper technique to evade **Google Play Protect**, fetching its malicious payload only after installation. Once deployed, Anatsa abused **Android Accessibility Services**, watched for targeted banking apps, and launched overlay screens to steal credentials, sensitive input, and multi-factor authentication codes. The malware allowed operators to initiate fraudulent transactions directly from infected devices, making activity appear more trustworthy to banks because it originated from a victim's normal device context. Reporting on the campaign said Anatsa continues to evolve to bypass traditional defenses by hiding inside legitimate-looking apps and abusing trusted mobile workflows, underscoring the risk to Android banking users and the need for tighter app controls, minimal permissions, and behavior-based monitoring.
Jun 29, 2026
**Kaspersky** reported a new Android malware campaign dubbed **BeatBanker** targeting users in Brazil, distributed via phishing sites that closely mimic the *Google Play Store* and lure victims into installing trojanized APKs posing as legitimate apps such as **Starlink** and the Brazilian government services app **INSS Reembolso**. The infection chain is staged to reduce suspicion: an initial decoy app presents a fake in-app “update” flow that prompts users to grant permission to install additional apps/modules, after which the malware pulls down further payloads and requests expanded privileges. Technical reporting indicates BeatBanker blends **banking trojan** capabilities with **cryptomining** (including a modified *XMRig*), and newer variants may deploy the commodity Android RAT **BTMOB** in place of the banking module, enabling broad device takeover (e.g., keylogging, screen recording, camera access, GPS tracking, and credential capture). The malware uses evasion techniques such as decrypting and loading hidden DEX code in-memory, performing anti-analysis environment checks, delaying malicious actions post-install, and maintaining persistence by continuously playing a near-inaudible MP3 (`output8.mp3`) to keep a foreground service alive and reduce the likelihood of the process being suspended by Android power management.
Jun 29, 2026