Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play

Anatsa (TeaBot) Banking Trojan Distributed via Fake "File (TL-2026-1059), also tracked as TeaBot, is a high-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects Google Android (Google Play Store distribution channel), maps to 23 MITRE ATT&CK techniques (T1406, T1407, T1417), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-1059

Threat ID
TL-2026-1059
Also known as
TeaBot
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-02
Last reviewed
2026-07-02
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
finance, banking, cryptocurrency
Target regions
united states of america, united kingdom, germany, spain, finland, south korea, singapore, Europe
Detection rules
9
Indicators of compromise
33

Malware and tooling in Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

Malware and tooling: AND/Agent5.AE, Anatsa, Android.Banker.Anatsa, AndroidOS/Agent.BOI

A dropper app named "File Horizon Explorer" (com.westhorizont.appsforge.filehorizon_explorereaddocuments), disguised as a document reader/file manager, was distributed on Google Play and delivered the Anatsa (TeaBot) Android banking trojan to over 100,000 devices. Anatsa abuses accessibility services to perform overlay-based credential theft, keylogging, and SMS interception against 831+ financial institutions and cryptocurrency platforms worldwide, using DES-encrypted string obfuscation, corrupted-ZIP anti-analysis tricks, and single-byte XOR-encrypted C2 traffic.

How Anatsa (TeaBot) Banking Trojan Distributed via Fake "File works

Anatsa (also tracked as TeaBot) is a mature Android banking trojan family, active since 2020, that Zscaler ThreatLabz has repeatedly observed being distributed through Google Play Store dropper applications masquerading as document readers, file managers, PDF viewers, and QR code scanners. In the campaign covered by this report, the dropper package com.westhorizont.appsforge.filehorizon_explorereaddocuments ("File Horizon Explorer") functioned as a fully working file-reading utility to pass Google Play review and satisfy sandboxed dynamic analysis, while covertly staging the Anatsa payload.

The infection chain follows Anatsa's established three-stage model: a benign-looking Stage 1 dropper (published under a legitimate-sounding developer identity to build trust and downloads) fetches a Stage 2 configuration/DEX component from attacker infrastructure once environmental checks (emulator detection, device-model verification, VM/sandbox fingerprinting) pass; a Stage 3 payload is then installed, in more recent campaign iterations directly as an APK update rather than via reflective DEX loading, streamlining infection and reducing detection surface. The payload is concealed using a corrupted ZIP archive technique — invalid/forged compression and encryption flags in the manifest that standard Java/Android ZIP parsers tolerate but which break common static-analysis and antivirus ZIP header validators. Internal strings, including C2 endpoints and configuration values, are protected with runtime DES decryption using dynamically generated keys, and C2 session traffic is further obscured with a single-byte XOR cipher (observed key value: decimal 66).

Once installed, Anatsa requests Accessibility Service permissions and abuses the granted API surface to silently self-grant additional dangerous permissions (SYSTEM_ALERT_WINDOW, READ_SMS, RECEIVE_SMS, USE_FULL_SCREEN_INTENT) without further user interaction. The trojan fingerprints installed applications on the device, and when a targeted banking, financial-services, or cryptocurrency-exchange app is detected, it downloads a tailored HTML/JavaScript injection page from C2 and renders it as a full-screen WebView overlay (using a JavaScript Interface / JSI bridge) on top of the legitimate app to phish credentials. A built-in keylogger driven by the Accessibility API records all on-device keystrokes, and SMS read/receive permissions let the malware intercept OTP/2FA codes and exfiltrate or suppress banking SMS notifications, enabling full account-takeover and transaction fraud even against institutions using SMS-based two-factor authentication.

The campaign this report covers targets over 831 financial institutions globally — an increase from the ~650 institutions targeted in earlier 2025 Anatsa waves — with expanded coverage of Germany and South Korea alongside established targeting of the US, UK, and broader Europe, plus more than 150 newly added banking and cryptocurrency applications. Operators rotate dropper package names, developer identities, and installer file hashes frequently to evade Play Store fraud detection and AV signature matching; related droppers in the same cluster (fileqrutility, tmzcwkcjd, filemanagerwithpdfsupport, fileedge_organizerviewer, docxploremanagerviewer, and others) collectively exceeded 90 apps and 5.5-19 million installs across successive waves tracked by Zscaler ThreatLabz.

MITRE ATT&CK techniques used in TL-2026-1059

Defense Evasion

T1406 Obfuscated Files or Information; T1407 Download New Code at Runtime; T1629 Impair Defenses; T1655 Masquerading

Credential Access

T1417 Input Capture; T1517 Access Notifications

credential-access

T1417.002 GUI Input Capture

discovery

T1418 Software Discovery

Discovery

T1426 System Information Discovery

Command and Control

T1437 Application Layer Protocol; T1509 Non-Standard Port; T1521 Encrypted Channel

Initial Access

T1475 Deliver Malicious App via Authorized App Store; T1476 Deliver Malicious App via Other Means

Collection

T1513 Screen Capture; T1533 Data from Local System; T1636 Protected User Data

Impact

T1516 Input Injection; T1643 Generate Traffic from Victim

Persistence

T1541 Foreground Persistence

persistence

T1624 Event Triggered Execution

Privilege Escalation

T1626 Abuse Elevation Control Mechanism

defense-evasion

T1633.001 System Checks

Affected products and versions in Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

  • Google — Android (Google Play Store distribution channel)
    Vulnerable versions: All Android versions supporting Accessibility Services API

Remediation for Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

Immediate actions

  • Uninstall com.westhorizont.appsforge.filehorizon_explorereaddocuments and any related dropper packages from affected devices
  • Force logout and reset credentials for any banking/crypto apps used on the infected device
  • Contact affected financial institutions to flag potential account takeover and monitor for fraudulent transactions
  • Block known C2 IPs and domains (162.252.173.37, 185.215.113.108, 193.24.123.18, 66.206.6.6, 185.215.113.31, 91.215.85.55, 37.235.54.59, menusand.com, becorist.com, saurkanot.com, docsresearchgroup.com) at perimeter/DNS
  • Revoke Accessibility Service and SMS permissions granted to unrecognized apps via Android Settings

Workarounds

  • Disable installation from unknown sources and side-loading on managed Android fleets
  • Enable Google Play Protect and ensure it is actively scanning installed apps

Longer-term hardening

  • Deploy mobile threat defense (MTD) / EDR on employee-owned and BYOD Android devices with banking app access
  • Enforce app-vetting policy restricting installation to Play Protect-verified publishers with install history
  • Implement app attestation / Play Integrity API checks in banking apps to detect compromised or overlay-affected devices
  • Educate users on risks of granting Accessibility Service permissions to non-accessibility utility apps

Weaknesses (CWE) in Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

CWE-506, CWE-451, CWE-311, CWE-522

Timeline of Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

  • Anatsa (TeaBot) Android banking trojan family first identified in the wild, initially targeting European financial institutions.
  • Zscaler ThreatLabz documents a new wave of Anatsa dropper apps on Google Play targeting Android users across Europe.
  • Security researchers report malicious dropper apps with 19+ million combined installs removed from Google Play for spreading Anatsa and related banking malware.
  • Zscaler ThreatLabz publishes technical analysis of active Anatsa campaigns on Google Play, detailing the three-stage dropper architecture and evasion techniques.
  • A separate Anatsa-distributing app with 220,000+ downloads is identified on Google Play, installing the banking trojan payload.
  • Zscaler ThreatLabz publishes updated tracking of Anatsa document-reader droppers, reporting expanded targeting of 831+ financial institutions including new coverage of Germany and South Korea plus cryptocurrency platforms.
  • "File Horizon Explorer" (com.westhorizont.appsforge.filehorizon_explorereaddocuments) identified on Google Play as an active Anatsa dropper with 100,000+ downloads.
  • Cyber Security News publishes coverage of the File Horizon Explorer Anatsa campaign, citing Zscaler ThreatLabz attribution and IOC details.
  • Threat ingested and researched by the Threadlinqs Intelligence platform via automated RSS hunt pipeline.

Sources cited for Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

Threats related to Anatsa (TeaBot) Banking Trojan Distributed via Fake "File

Detection coverage for TL-2026-1059

As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1059 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1059

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats