Cloud security vendor Zscaler says customers of Google’s Play Store have downloaded more than 19 million instances of malware-laden apps that evaded the web giant’s security scans. Zscaler’s ThreatLabz spotted and reported 77 apps containing malware, many of them purporting to be utilities or personalization tools. Many contained an updated version of the Anatsa banking trojan, malware that first appeared in 2020. The latest build includes a keylogger for password collection, SMS interception capabilities, and anti-detection tools. Zscaler thinks it’s being used to target 831 financial institutions globally, including both crypto exchanges and regular banks. What makes the new strain particularly worrisome is its ability to hide in plain sight, as demonstrated by the failure of Google's malware detection systems. The latest build of Anatsa downloads each new chunk of code with a separate DES key to make detection harder, and alters its name to make it harder for scanners to spot. "The core payload has been updated to incorporate a new keylogger variant of Anatsa. Additionally, the malware utilizes a well-known Android APK ZIP obfuscator for enhanced evasion. The payload is concealed within a JSON file, which is dynamically dropped at runtime and promptly deleted after being loaded," Zscaler reported. "The APK uses a corrupted archive to hide a file, which is deployed during runtime. This archive has invalid compression and encryption flags, making it hard for static analysis ...
Malware-ridden apps made it into Google's Play Store, scored 19 million downloads
The Register
·Iain Thomson
·Published Aug 26, 2025
·Updated
Affected Software
2 affected components
Google Play Store
Zscaler ThreatLabz
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses the discovery of malware-ridden apps that were downloaded over 19 million times from Google's Play Store.
2
What security implications are discussed?
The article highlights the failure of Google's security scans to detect malicious apps, raising concerns over user safety on the Play Store.
3
What products or software are affected?
The affected software includes various malicious apps available on the Google Play Store.
4
Who identified the malware-infected apps?
The malware-laden apps were identified by the cloud security vendor Zscaler through their ThreatLabz team.
5
How many downloads did the malware apps achieve before detection?
The malware apps collectively scored over 19 million downloads before being reported.