# Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play

> A dropper app named "File Horizon Explorer" (com.westhorizont.appsforge.filehorizon_explorereaddocuments), disguised as a document reader/file manager, was distributed on Google Play and delivered the Anatsa (TeaBot) Android banking trojan to over 100,000 devices. Anatsa abuses accessibility services to perform overlay-based credential theft, keylogging, and SMS interception against 831+ financial institutions and cryptocurrency platforms worldwide, using DES-encrypted string obfuscation, corrupted-ZIP anti-analysis tricks, and single-byte XOR-encrypted C2 traffic.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1059
- **ID:** TL-2026-1059
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Anatsa (also tracked as TeaBot) is a mature Android banking trojan family, active since 2020, that Zscaler ThreatLabz has repeatedly observed being distributed through Google Play Store dropper applications masquerading as document readers, file managers, PDF viewers, and QR code scanners. In the campaign covered by this report, the dropper package com.westhorizont.appsforge.filehorizon_explorereaddocuments ("File Horizon Explorer") functioned as a fully working file-reading utility to pass Google Play review and satisfy sandboxed dynamic analysis, while covertly staging the Anatsa payload.

The infection chain follows Anatsa's established three-stage model: a benign-looking Stage 1 dropper (published under a legitimate-sounding developer identity to build trust and downloads) fetches a Stage 2 configuration/DEX component from attacker infrastructure once environmental checks (emulator detection, device-model verification, VM/sandbox fingerprinting) pass; a Stage 3 payload is then installed, in more recent campaign iterations directly as an APK update rather than via reflective DEX loading, streamlining infection and reducing detection surface. The payload is concealed using a corrupted ZIP archive technique — invalid/forged compression and encryption flags in the manifest that standard Java/Android ZIP parsers tolerate but which break common static-analysis and antivirus ZIP header validators. Internal strings, including C2 endpoints and configuration values, are protected with runtime DES decryption using dynamically generated keys, and C2 session traffic is further obscured with a single-byte XOR cipher (observed key value: decimal 66).

Once installed, Anatsa requests Accessibility Service permissions and abuses the granted API surface to silently self-grant additional dangerous permissions (SYSTEM_ALERT_WINDOW, READ_SMS, RECEIVE_SMS, USE_FULL_SCREEN_INTENT) without further user interaction. The trojan fingerprints installed applications on the device, and when a targeted banking, financial-services, or cryptocurrency-exchange app is detected, it downloads a tailored HTML/JavaScript injection page from C2 and renders it as a full-screen WebView overlay (using a JavaScript Interface / JSI bridge) on top of the legitimate app to phish credentials. A built-in keylogger driven by the Accessibility API records all on-device keystrokes, and SMS read/receive permissions let the malware intercept OTP/2FA codes and exfiltrate or suppress banking SMS notifications, enabling full account-takeover and transaction fraud even against institutions using SMS-based two-factor authentication.

The campaign this report covers targets over 831 financial institutions globally — an increase from the ~650 institutions targeted in earlier 2025 Anatsa waves — with expanded coverage of Germany and South Korea alongside established targeting of the US, UK, and broader Europe, plus more than 150 newly added banking and cryptocurrency applications. Operators rotate dropper package names, developer identities, and installer file hashes frequently to evade Play Store fraud detection and AV signature matching; related droppers in the same cluster (fileqrutility, tmzcwkcjd, filemanagerwithpdfsupport, fileedge_organizerviewer, docxploremanagerviewer, and others) collectively exceeded 90 apps and 5.5-19 million installs across successive waves tracked by Zscaler ThreatLabz.

## MITRE ATT&CK

- T1476 Deliver Malicious App via Other Means
- T1475 Deliver Malicious App via Authorized App Store
- T1624 Event Triggered Execution
- T1541 Foreground Persistence
- T1626 Abuse Elevation Control Mechanism
- T1655 Masquerading
- T1406 Obfuscated Files or Information
- T1633.001 System Checks
- T1407 Download New Code at Runtime
- T1629 Impair Defenses
- T1418 Software Discovery
- T1417 Input Capture
- T1417.002 GUI Input Capture
- T1517 Access Notifications
- T1426 System Information Discovery
- T1533 Data from Local System
- T1513 Screen Capture
- T1636 Protected User Data
- T1521 Encrypted Channel
- T1437 Application Layer Protocol
- T1509 Non-Standard Port
- T1516 Input Injection
- T1643 Generate Traffic from Victim

## Sources

- [Fake Document Reader in the Google Play Store](https://cybersecuritynews.com/fake-document-reader-in-the-google-play-store/)
- [Anatsa Campaign Technical Analysis](https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-campaigns-android-banking-malware-active-google)
- [Android Document Readers and Deception: Tracking the Latest Updates to Anatsa](https://www.zscaler.com/blogs/security-research/android-document-readers-and-deception-tracking-latest-updates-anatsa)
- [TeaBot Banking Trojan Activity on the Rise, Zscaler Observes](https://www.infosecurity-magazine.com/news/teabot-banking-trojan-activity/)
- [Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware](https://securityaffairs.com/181528/malware/malicious-apps-with-19m-installs-removed-from-google-play-because-spreading-anatsa-banking-trojan-and-other-malware.html)
- [Android App With 220,000+ Downloads From Google Play Installs Banking Trojan](https://cybersecuritynews.com/android-app-with-220000-downloads/)
- [Anatsa Malware Escalates: Android Under Siege as Hackers Harvest Credentials and Track Keystrokes](https://gbhackers.com/anatsa-malware-escalates-android-under-siege-as-hackers/)
- [New Wave of 'Anatsa' Banking Trojans Targets Android Users in Europe](https://www.darkreading.com/mobile-security/new-wave-of-anatsa-banking-trojan-attacks-targets-android-users-in-europe)
- [Malware - Anatsa Banking Trojan for Android](https://defensestorm.com/threatalert/malware-anatsa-banking-trojan-for-android/)
- [Anatsa Trojan (Android) - Malware removal instructions](https://www.pcrisk.com/removal-guides/23778-anatsa-trojan-android)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1059