Anatsa: The Android Banking Trojan That Keeps Returning to Google Play

Anatsa (also tracked as TeaBot and Toddler) is an Android banking trojan active since around 2020, first flagged by Cleafy and closely tracked by ThreatFabric and Zscaler. It stands out because it is repeatedly delivered through the official Google Play Store via “dropper” apps — defeating the assumption that Play is safe — and because it enables on-device, automated fraud rather than just credential theft.

The Dropper Playbook

Operators publish decoy utilities — PDF readers, QR and document viewers, file managers — that work as advertised. They register a developer profile, build an install base, then push the malicious payload later as a fake “update,” fetching the payload location from external infrastructure. This staged activation is how droppers pass Play review; droppers have also been observed bypassing Android 13 restricted-settings protections (reported early 2024). T1407

Capabilities

• Overlay attacks — fake login screens drawn over real banking apps — plus keylogging and SMS interception. T1417.002 T1417.001 T1636
• Heavy abuse of Android Accessibility Services for remote control and to auto-grant itself permissions. T1626 T1516
• Device-Takeover Fraud (DTO): initiating fraudulent transactions from the victim’s own device to evade anti-fraud checks. Zscaler reported the payload manipulates APK ZIP headers to break static analysis and checks for emulators.

Campaigns

ThreatFabric and Zscaler have tracked recurring waves: 2023 campaigns against US, UK and DACH banks; a late-2023/early-2024 expansion into Central Europe; and Zscaler’s 2024 tracking of dozens of malicious apps with millions of combined installs (a vendor figure). ThreatFabric reported a 2025 North America campaign in which a document-viewer dropper flipped malicious and showed a fake “maintenance” overlay. Install counts vary between sources — treat specific numbers as indicative.

Detection & Mitigation

• Enforce Google Play Protect, restrict sideloading, and use MDM to block apps requesting Accessibility without a business need.
• Alert on apps requesting Accessibility services after install — especially “utility” apps (PDF/QR/file) — and scrutinise post-install “update” prompts.
• Banks should deploy on-device behavioural anti-fraud (overlay detection, device-takeover and remote-session signals) rather than relying on credential checks alone.
• Educate users not to grant Accessibility to document or QR utilities, and consume vendor feeds (ThreatFabric, Zscaler, Cleafy) for current package names and C2.