The Nigeria Computer Emergency Response Team (ngCERT) under the Office of the National Security Adviser has warned Nigerians using Android devices about a malware called Anatsa banking trojan. This malware targets banking apps and steals financial information from users.
The advisory from ngCERT highlights increasing reports of cyber threats to bank customers, prompting this warning.
How the Anatsa Banking Trojan Works
According to ngCERT, the Anatsa trojan exploits Android’s accessibility services to gain complete control over infected devices. Once installed, it can:
- Launch phishing attacks with fake login screens to capture banking credentials.
- Record keystrokes and intercept payment information.
- Remotely interact with the device, performing clicks, scrolls, and swipes.
- Prevent users from accessing certain apps, including security applications.
The malware is delivered through malicious apps that appear to be legitimate PDF and QR code readers or cleaner apps. These apps initially behave normally but later download, decrypt, and execute the trojan’s payload. This payload establishes a connection with a command and control (C2) server, awaiting instructions from the attacker.
NgCERT has identified that the trojan has been distributed through various apps on the Google Play Store and has infected over 70,000 devices.
Protecting Your Phone Against Malware
NgCERT urges Android users to take the following precautions:
Avoid Installing Untrusted Apps: Only download apps from trusted sources. Carefully review app ratings and user feedback on the Google Play Store.
Be Wary of Unnecessary Permissions: Exercise caution with apps requesting excessive permissions, especially those related to accessibility services or the installation of unknown apps.
Uninstall Suspicious Apps: If you suspect an app contains the Anatsa trojan, uninstall it immediately and scan your device with a reputable antivirus application.
Monitor Banking Activity: Regularly change banking passwords and closely monitor account activity. Report any suspicious transactions to your financial institution promptly.
NgCERT emphasizes the significant threat posed by the Anatsa banking trojan and urges users to follow these guidelines to safeguard their personal and financial information.
