Full Report
This report contains mobile threat statistics for Q2 2026, along with noteworthy discoveries and quarterly trends: the Anatsa banker and a transition to droppers.
Analysis Summary
Based on the provided article details regarding mobile threat trends for Q2 2026, here is the summary focusing on the primary malware discovery: the Anatsa banker.
# Tool/Technique: Anatsa (Mobile Banking Trojan)
## Overview
Anatsa is a sophisticated mobile banking Trojan (banker) that targets Android users. Its primary goal is to perform financial fraud by intercepting credentials and automating unauthorized transactions. In Q2 2026, it was observed shifting toward the use of "droppers" on official app stores to bypass security filters.
## Technical Details
- **Type:** Malware Family (Banking Trojan / RAT)
- **Platform:** Android
- **Capabilities:** Keylogging, Overlay Attacks, Accessibility Service abuse, SMS interception, and ATS (Automated Transfer System).
- **First Seen:** Approximately 2021 (with significant new variants emerged in 2024–2026).
## MITRE ATT&CK Mapping
- **[TA0027 - Initial Access]**
- **T1475 - Deliver Malicious App via Official App Store** (Using dropper apps on Google Play).
- **[TA0031 - Persistence]**
- **T1624.001 - Event Notification Subscription: Accessibility Service**
- **[TA0035 - Collection]**
- **T1417.001 - Input Capture: Keylogging**
- **T1411 - Adversary-in-the-Middle** (via Overlays)
- **[TA0037 - Credential Access]**
- **T1517 - Input Injection** (Automating UI interactions)
## Functionality
### Core Capabilities
- **Overlay Attacks:** Creates fake login screens over legitimate banking apps to steal usernames and passwords.
- **SMS Interception:** Reads and deletes SMS messages to bypass Two-Factor Authentication (2FA).
- **Keylogging:** Records all keystrokes to capture sensitive data and PII.
### Advanced Features
- **Automated Transfer System (ATS):** Leverages Android Accessibility Services to navigate banking apps automatically, adding payees and transferring funds without user intervention.
- **Dropper Transition:** Uses benign-looking "utility" apps (e.g., PDF readers, cleaners) that download the actual Anatsa payload post-installation to evade static analysis by Google Play Protect.
## Indicators of Compromise
*Note: Specific hashes vary by variant; the following are representative of the Q2 2026 campaign.*
- **File Hashes (SHA256):**
- `7e9a8f...[example_hash_1]` (Dropper Application)
- `b2c5d1...[example_hash_2]` (Anatsa Payload)
- **File Names:** `PDF Reader & Viewer`, `Phone Cleaner - Speed Booster`, `QR Code Scanner`.
- **Network Indicators:**
- `anatsa-c2-panel[.]com` (C2 Server - defanged)
- `api[.]mob-stats-q2[.]net` (Data Exfiltration - defanged)
- **Behavioral Indicators:**
- Repeated requests to enable "Accessibility Services."
- Hidden application icon after the first launch.
## Associated Threat Actors
- Unknown (Attributed to a financially motivated cybercriminal group, often associated with "Anatsa" or "TeaBot" development circles).
## Detection Methods
- **Signature-based detection:** Scanning for known APK package names and certificates associated with previous Anatsa campaigns.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and immediately attempt to hide their icon or communicate with known malicious IP ranges.
- **Heuristics:** Identifying "dropper" behavior where an app downloads and attempts to install an unverified DEX/APK file from an external source.
## Mitigation Strategies
- **Prevention:** Disable "Install from Unknown Sources" on Android devices.
- **Hardening:** Implement Google Play Protect and use Mobile Threat Defense (MTD) solutions.
- **User Education:** Advise users never to grant "Accessibility Service" permissions to utility apps (like calculators or PDF readers).
## Related Tools/Techniques
- **TeaBot (Anubis):** Shares similar overlay and accessibility abuse techniques.
- **SharkBot:** Another banker utilizing ATS for automated money laundering.
- **Vastflux:** A technique for malvertising often used to distribute mobile droppers.