Critical THREAT

PDF Reader & Document Scanner QR Malware

Technical Analysis & Behavior

Identified by ThreatFabric: clean-looking PDF & QR Scanner utility on Google Play that downloads the Anatsa (TeaBot) banking trojan days after installation via a fake 'PDF Add-on' update.

Package ID / SHA256 Hash

com.pdf.reader.qrscanner.pro

Threat Family

Anatsa (TeaBot) Banking Trojan Dropper

Target Platform

Google Play (Removed)

Date Logged

2026-10-17

Device Compromised? Scan & Protect Your Identity

If you installed or interacted with this APK, your credentials, 2FA codes, and banking apps may be exposed. Activate real-time mobile antivirus protection immediately.

🛡️ Activate Surfshark Antivirus & Alternative ID 🔒 Cloud APK Sandbox — Coming Soon