Skip to content
Malicious Android Apps Disguised as Utilities Target Millions

Malicious Android Apps Disguised as Utilities Target Millions

First seen 22 Sep 2026, 17:33 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 22, 2026 at 19:25 UTC
  • Over 90 malicious Android apps have been identified, downloaded over 5.5 million times.
  • Anatsa malware disguises itself as legitimate applications before delivering harmful payloads.
  • Users must remain vigilant when downloading apps, as Google Play Protect may not catch all threats.

Recent reports reveal that over 90 malicious Android apps, including PDF Reader & File Manager, have been downloaded more than 5.5 million times from the Google Play Store. These apps utilize Anatsa malware, which initially appears harmless but later downloads malicious code disguised as legitimate updates. This malware targets banking apps, stealing sensitive information by presenting fake login pages. Despite Google's efforts to remove identified malicious apps, the threat persists as new variants emerge. Users are urged to exercise caution when downloading apps, even from official stores, as malware can evade detection. The situation highlights the ongoing risks associated with mobile app security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-01-01
Malwarebytes report on malicious apps
Malwarebytes reported that Google removed 77 malicious apps in 2025, installed 19 million times.
Android Police
2026-09-20
User discovers malicious PDF reader app
A user found a PDF reader app that was adware and not flagged by Google Play Protect or Samsung's app protection.
Android Police
2026-09-22
Zscaler identifies 90 malicious apps
Zscaler reported that over 90 malicious Android apps have been downloaded 5.5 million times, spreading Anatsa malware.
BGR

More articles in this cluster (2)

Following this threat?

Track Anatsa in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed