The danger from Anatsa, the malware that is 'raging' on Android

DNVN - A new type of malware called Anatsa has just been warned by banks in Vietnam that is spreading rapidly on the Android platform. This malware impersonates legitimate applications, inserting fake screens of banking applications to steal passwords and OTP codes - causing money in customer accounts to be withdrawn in just a few seconds.

Banks in Vietnam have just issued warnings to customers about the risk from Anatsa malware - a banking trojan that attacks Android devices, specializes in accessing and taking control through users granting "Accessibility" permission or SMS access.

According to the article, Anatsa often disguises itself as a legitimate utility application such as “PDF Reader”, “Document Reader” and is uploaded directly to the Google Play app store to lure users into installing it. After installation, the application will download an update containing malicious code and take over the device.

(Illustration)

When users access their banking application, the malware inserts a fake interface (overlay) that looks exactly like the real interface, so users can enter their username, password, and OTP code - all of which is sent to the bad guys' server.

Some signs that your device may be infected with malware include: apps requesting special “Accessibility” or SMS permissions that were not previously available; the device opening a banking app and asking to log in again in an unusual way; strange pop-ups appearing on the screen when accessing the bank; rapid battery drain, and sudden increases in mobile data usage.

According to the Ministry of Public Security , in the first 8 months of 2025, Vietnam recorded nearly 1,500 online fraud cases, causing losses of more than 1,660 billion VND. Cybercrime is not only about stealing information but also combines more sophisticated tricks such as impersonating bank employees, using deep-fake technology, and luring users to download malicious applications.

Faced with the risk, banks recommend that users should: only install applications from reputable developers; carefully check the requested permissions before granting; activate two-factor authentication (2FA) for bank accounts; regularly update the operating system and applications on the device; if they detect unusual transactions or suspect malware infection, they should immediately contact the bank for support.

For Android devices, if the downloaded application requires “Accessibility” permission, users should check again by going to Settings > Accessibility > Apps (Accessibility) and turning off permissions for applications from unknown sources. A device can be controlled remotely and the money in the account “evaporates” in just a few seconds when the user logs into the banking application.

The lesson for all users is: Personal financial security is not only guaranteed by banks - users must also be proactive. Even if you think "you have nothing to lose", losing money from the bank just because you install a "small" application can happen. Mobile devices are now financial gateways - so every access or application downloaded has potential risks.

Nguyen Bach

Source: https://doanhnghiepvn.vn/cong-nghe/nguy-co-tu-anatsa-ma-doc-dang-hoanh-hanh-tren-android/20251020045512973