Dangerous Android app discovered: Anatsa banking trojan distributed through a Google Play PDF reader

A seemingly harmless PDF reader from Google Play has prompted a security warning. Reports covering an alert from Zscaler ThreatLabz identify an app that can download the Anatsa banking trojan onto Android phones. The reported distribution exceeds 10,000 installations. If you use a PDF reader, check whether this particular app is installed on your device.

Which Android app is affected?

The October 2026 reports identify “PDF Reader” by developer Duka Zuri. It was distributed through the official Google Play Store and initially appeared to be an ordinary document viewer.

The reported technical package name is:

com.railforge.footplate.documentreader_pdfviewer

This identifier helps distinguish the app from other PDF readers. Its generic display name alone is insufficient: Not every app called “PDF Reader” is affected.

According to the current reports, the app has since been removed from Google Play. Removal from the store does not automatically remove copies already installed on phones. A missing store listing alone is also not proof that an app is malicious or that a device is infected.

What does the Anatsa banking trojan do?

Anatsa, also known as TeaBot, is malware capable of stealing credentials and financial information. In earlier campaigns, Zscaler documented apparently useful apps acting as droppers: The app installed first downloads the actual malicious component later.

Known techniques include placing fake login screens over genuine banking apps. Victims believe they are signing in to their bank but instead send their credentials to criminals. Abuse of Android accessibility services is particularly concerning. If granted the relevant permissions, malware can perform extensive actions on the device.

These behaviours are documented in earlier technical analyses of the malware family. They do not establish that every feature is implemented identically in every newly reported sample.

Important: More than 10,000 installations refers to the reported reach of the disguised app, not the number of confirmed infections or affected bank customers. The number of devices actually infected is unknown.

What should you do now?

If the identified app is installed on your phone, or you have a specific reason to suspect an infection, act promptly:

1. Check and remove the app: Open Android Settings and review the application under “Apps”. Compare the developer and, where available, package name with the details above. Uninstall the affected app. Do not reopen it to test whether it is malicious.
2. Run Play Protect: Open your profile menu in Google Play, select “Play Protect” and scan the device. Keep protection enabled. A clean scan alone does not guarantee that the device is safe.
3. Review permissions: Pay particular attention to unknown apps with access to accessibility services. Revoke unnecessary permissions. Menu names vary by Android version and device manufacturer.
4. Check your bank account: Watch for unfamiliar sign-ins or transactions. Report suspicious activity promptly using your bank’s established official contact channels.
5. Secure your credentials: If you suspect an infection, use a different, trusted device to contact your bank and change affected passwords. Do not enter further banking credentials on the potentially compromised phone.
6. Update Android: Install available Android, security and Google Play system updates. Review your Google Account’s security as well.

If the app cannot be removed, an infection is confirmed or suspicious behaviour continues, seek help from the device manufacturer or a trusted technical specialist. A full factory reset may be necessary. Back up important personal data first, and do not restore the suspicious app afterwards. Cleaning the phone does not resolve possible financial losses: Discuss those separately with your bank.

Conclusion: Official app stores do not eliminate every risk

This case illustrates that Google Play does not offer complete protection against malware. Be particularly cautious when simple utilities such as PDF readers request extensive permissions or ask you to install additional components outside the normal update process.

Choose trustworthy apps, keep Android up to date and review permissions regularly. Identify the specific application using its developer and package name rather than relying on its display name alone.