A nationwide campaign sends SMS 'Post office: your app is out of date, download now' with a link to post-update.tk. The link installs Anatsa, an Android banking trojan that masquerades as a PDF reader during initial install.
Once installed, Anatsa requests accessibility services to 'read PDF'. After 48 hours it injects fake overlays on the legitimate bank app when the user opens it, stealing credentials and OTP in real time. A Padua accountant lost 14,500 EUR in three night transactions.
Mythos analyzed the APK: signing certificate linked to a known Anatsa cluster, manifest with accessibility and overlay permissions, binary hash in threat-intel feeds. The dossier linked the victim to a wider campaign with over 4,200 infected devices in Italy.