Malicious Document Reader App on Google Play Delivers Android Banking Trojan

Zimperium

Malicious Document Reader App on Google Play Delivers Android Banking Trojan

First seen 24 Jun 2026, 21:40 UTC • •66.0

Article Content

1 / 4

Browse articles

ThreatCluster •June 25, 2026 at 21:30 UTC

•A fake document reader app on Google Play has over 100,000 downloads and delivers malware.
•The app contains a banking trojan that risks financial theft and personal data loss.
•Users are urged to be cautious about app permissions and the sources of their downloads.

A newly identified Android malware campaign is exploiting a fake document reader app, which has amassed over 100,000 downloads on the Google Play Store. This app masquerades as a legitimate file utility but contains a banking trojan that poses significant risks to users' financial and personal data. The malicious payload activates after installation, targeting Android devices and potentially leading to financial theft. The campaign highlights ongoing vulnerabilities in app store security and the need for users to be cautious about app permissions and sources. As of now, the app remains available for download, increasing the urgency for user awareness and action.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 108d ago How this analysis works

Timeline

2026-06-24

Malicious app identified on Google Play

A fake document reader app was found to contain a banking trojan, downloaded over 100,000 times, posing risks to users.

2026-06-24

Cybersecurity alert issued

Security experts warn users about the risks associated with the fake app and recommend vigilance in app downloads.

Cybersecuritynews

More articles in this cluster (3)

Threat Graph

4 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Malware

Campaign (1)

Anatsa Campaign

Malware (1)

Anatsa

Affected Platform (1)

Android

Relationships

Anatsa Campaign uses Anatsa
Malware targets Android

Following this threat?

Track Anatsa in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Malicious Android Apps Disguised as Utilities Target Millions Recent reports reveal that over 90 malicious Android apps, including PDF Reader & File Manager, have been downloaded more than 5.5 million times from the Google Play Store. These apps utilize Anatsa malware, which initially appears harmless but later downloads malicious code disguised as legitimate updates. This…

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…