---
title: Anatsa Android Trojan Now Steals Banking Info From Users
description: Anatsa Android Trojan Now Steals Banking Info From Users
---

[Securafy Knowledge Hub](https://blog.securafy.com)

- [Topics](https://blog.securafy.com/#sf-cover)
- [Tools](https://blog.securafy.com/#sf-tools)
- [Books & Guides](https://blog.securafy.com/#sf-books)

[Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)

[Topics](https://blog.securafy.com/#sf-cover) [Tools](https://blog.securafy.com/#sf-tools) [Books & Guides](https://blog.securafy.com/#sf-books) [Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call)

[Knowledge Hub](https://blog.securafy.com) / IT Operations

IT Operations

# Anatsa Android Trojan Now Steals Banking Info From Users

Anatsa Android Trojan Now Steals Banking Info From Users

![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png) By Randy Hall Updated Jul 2024 3 min read Share [**](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users) [**](https://twitter.com/intent/tweet?url=https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users&text=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EAnatsa+Android+Trojan+Now+Steals+Banking+Info+From+Users%3C%2Fspan%3E) [**](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EAnatsa+Android+Trojan+Now+Steals+Banking+Info+From+Users%3C%2Fspan%3E&body=https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users)

![](https://static.hsstatic.net/BlogImporterAssetsUI/ex/missing-image.png)Do you know that your handy smartphone could cause harm to your business? A Trojan called Anatsa is causing trouble to banks and business owners. This Anatsa is sneakier and more harmful than ever, making it a serious threat to businesses.

**Understanding the Threat**

Anatsa falls under the category of a "Trojan" virus. Once it is in your computer or phone, a Trojan can steal your personal information or damage your device. It is named after the "Trojan Horse" in Greek mythology because it sneaks in, pretending to be something it is not.

The Anatsa Trojan aims to get your sensitive details, like your bank login details or credit card numbers. It does this by tricking you into entering your details into a fake screen and tracking what you type.

Anatsa's advanced features, such as its Device-Takeover Fraud (DTO), let it take over your device and sneak past your bank's security systems. It then secretly takes your mobile banking login details. It even starts making purchases without you knowing.  
 The creators of the Anatsa Trojan have made it more dangerous. They started a new campaign in March 2023, targeting banks in the U.S., U.K., and some parts of Europe. Alarmingly, this malware infected over 30,000 devices.

**How Anatsa Enters Your Smartphone**

Anatsa sneaks into your phone through apps. Five apps have been found to be high-risk:

- All Document Reader & Editor - com.mikijaki.documents.pdf reader.xlsx.csv.ppt.docs
- PDF Reader & Editor - moh.filemanagerrespdf
- PDF Reader & Editor - com.proderstarler.pdfsignature
- All Document Reader and Viewer - com.muchlensoka.pdfcreator
- PDF Reader - Edit & View PDF -lsstudio.pdf reader.powerful tool.allinonepdf.goodpdftools

If you have these applications on your device, you should delete them right away.

**Steps for Protecting Your Business**

The recent rise of Anatsa shows the risks businesses face today. But there are ways to protect your business from this Trojan:

- Educate yourself. Stay updated about threats like Anatsa. Awareness is the first step toward prevention.
- Verify apps. Always make sure an app is safe before you download it. This action reduces the chance of downloading Trojan-infected apps.
- Use security software. Install a reliable security app on your device. These apps can find and block malicious software like Anatsa.

**Act Early and Protect Your Future**

The Anatsa Trojan shows how cyber threats to business owners are changing and becoming more sophisticated. You can prevent significant losses by knowing the risks and taking steps to protect your business. Acting fast and staying informed can help keep your business safe in today's evolving cybersecurity landscape.

Tagged Under IT Operations[Cybersecurity](https://blog.securafy.com/tag/cybersecurity)Business Continuity

In This Article

Need Help With Your Current Setup?

Talk through your current systems, risks, and support gaps with Securafy.

[Book a Strategy Call](https://meetings.hubspot.com/securafy/strategy-call)

## Join The Conversation

Have a question or perspective on this topic? Add it below.

![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png)

About The Author

Randy Hall · CEO & Founder

Randy Hall is the CEO and Founder of Securafy, with decades of experience helping organizations make smarter, safer decisions about technology.

 A frequent speaker and instructor at national IT events, Randy has advised thousands of organizations, from startups and SMBs to large enterprises and U.S. government entities, on secure, practical technology adoption. He writes about the decisions business leaders are often expected to make without enough context, including cybersecurity, compliance, AI, cyber insurance, IT strategy, and business resilience.

 Outside the office, you’ll often find Randy on Lake Erie enjoying time on his 38-foot Chris-Craft.

**Writes about:** Cybersecurity strategy, compliance, AI security, business resilience, cyber insurance, SMB risk, IT leadership

[More From This Author →](https://blog.securafy.com/author/randyhall)

Related Articles

Business Continuity [Compliance Risk Assessment: How Downtime Impacts Your Bottom Line](https://blog.securafy.com/compliance-risk-assessment-how-downtime-impacts-your-bottom-line)

When systems go down, compliance obligations don't pause—and the financial consequences ...

Jul 28, 2026

Compliance [HIPAA Security Rule Changes Are Delayed To 2027: Why Healthcare Organizations Should Not Wait](https://blog.securafy.com/hipaa-security-rule-changes-are-delayed-to-2027-why-healthcare-organizations-should-not-wait)

The updated HIPAA Security Rule won't take effect until 2027, but healthcare ...

Jul 23, 2026

Compliance [Multi Factor Authentication Best Practices for CJIS Security Policy Compliance](https://blog.securafy.com/multi-factor-authentication-best-practices-for-cjis-security-policy-compliance)

Law enforcement agencies and criminal justice organizations face mounting pressure to ...

Jul 16, 2026

Compliance [CMMC Phase II Has Been Suspended: What Defense Contractors Still Need To Do](https://blog.securafy.com/cmmc-phase-ii-has-been-suspended-what-defense-contractors-still-need-to-do)

The Department of Defense suspended CMMC Phase II enforcement, but that doesn't mean ...

Jul 15, 2026

IT Operations [Cybersecurity For Veterinary Clinics: Protecting Client Data, Payment Systems, And Practice Operations](https://blog.securafy.com/cybersecurity-for-veterinary-clinics-protecting-client-data-payment-systems-and-practice-operations)

Veterinary clinics handle sensitive client data, payment information, and critical ...

Jul 9, 2026

IT Operations [AT&T Cybersecurity, AlienVault USM, And Managed Security: What SMBs Still Need To Own](https://blog.securafy.com/att-cybersecurity-alienvault-usm-and-managed-security-what-smbs-still-need-to-own)

Managed security platforms like AT&T Cybersecurity and AlienVault USM provide ...

Jul 8, 2026

Get Practical Cybersecurity Field Notes

Monthly cybersecurity, compliance, and IT strategy updates from Securafy, written for business owners who need clear next steps.

- Practical security tips from our Cyber Security Drip series
- The Securafy Times, our monthly roundup on compliance and IT strategy
- Occasional updates on new tools, guides, and research
- No spam — unsubscribe anytime

NIST CSF 2.0 Zero Trust Application Control CISA Aligned Enterprise Partner

© 2026 Securafy — Columbus & Cleveland, Ohio

[Main Site](https://www.securafy.com/) [Blog Home](https://blog.securafy.com/) [Contact](https://www.securafy.com/contact.html) [Privacy Policy](https://www.securafy.com/privacy-policy.html)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Randy Hall",
    "url" : "https://blog.securafy.com/author/randyhall"
  },
  "dateModified" : "2024-07-24T20:18:20.317Z",
  "datePublished" : "2023-07-04T15:00:00.000Z",
  "headline" : "Anatsa Android Trojan Now Steals Banking Info From Users",
  "mainEntityOfPage" : {
    "@id" : "https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.securafy.com/hubfs/securafy-logo.png"
    },
    "name" : "Securafy Inc."
  }
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securafy.com/#organization",
  "@type" : "Organization",
  "address" : [ {
    "@type" : "PostalAddress",
    "addressLocality" : "Columbus",
    "addressRegion" : "OH",
    "postalCode" : "43219",
    "streetAddress" : "4449 Easton Way, Suite 200"
  }, {
    "@type" : "PostalAddress",
    "addressLocality" : "Independence",
    "addressRegion" : "OH",
    "postalCode" : "44131",
    "streetAddress" : "6100 Oak Tree Blvd, Suite 200"
  } ],
  "areaServed" : [ "Columbus OH", "Cleveland OH", "Ohio" ],
  "name" : "Securafy Inc.",
  "url" : "https://securafy.com/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://securafy.com/#website",
  "@type" : "WebSite",
  "inLanguage" : "en-US",
  "name" : "Securafy",
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://securafy.com/"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://blog.securafy.com/#blog",
  "@type" : "Blog",
  "name" : "Securafy Knowledge Hub",
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://blog.securafy.com"
}
```

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users#article",
  "@type" : "Article",
  "author" : {
    "@id" : "https://www.securafy.com/about-us/#randyhall",
    "@type" : "Person",
    "name" : "Randy Hall"
  },
  "dateModified" : "2024-07-24T20:18:20+00:00",
  "datePublished" : "2023-07-04T15:00:00+00:00",
  "description" : "Anatsa Android Trojan Now Steals Banking Info From Users",
  "headline" : "Anatsa Android Trojan Now Steals Banking Info From Users",
  "image" : "https://www.securafy.com/hs-fs/hubfs/securafy-og-default.jpg",
  "inLanguage" : "en-US",
  "isPartOf" : {
    "@id" : "https://blog.securafy.com/#blog"
  },
  "mainEntityOfPage" : {
    "@id" : "https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@id" : "https://securafy.com/#organization"
  },
  "url" : "https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://blog.securafy.com",
    "name" : "Knowledge Hub",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://blog.securafy.com/2023/07/04/anatsa-android-trojan-now-steals-banking-info-from-users",
    "name" : "Anatsa Android Trojan Now Steals Banking Info From Users",
    "position" : 2
  } ]
}
```