Google has deleted millions of apps from the Play Store after a serious malware threat was discovered. Security experts are warning Android users to act quickly to secure their devices and financial data.
Google has confirmed a massive cleanup of the Play Store. Millions of apps have been removed, and the reason is alarming: a dangerous malware campaign targeting Android devices worldwide. Known as Anatsa, or TeaBot, this malware has been silently stealing banking credentials, hijacking financial transactions, and spying on user activity.
Why Google Deleted Millions of Apps
In August 2025, researchers at Zscaler identified 77 malicious apps with over 19 million downloads. These apps looked harmless—like document readers or utility tools—but were secretly working as malware droppers. Once installed, they downloaded hidden malicious payloads from remote servers.
Google responded by deleting these apps immediately. However, deleting apps from the Play Store does not remove them from devices. This means users must take action themselves.
How Anatsa Malware Works
Anatsa is one of the most advanced Android banking trojans. It can:
- Show fake login screens for banking apps to steal usernames and passwords
- Record keystrokes and monitor user activity
- Perform fraudulent transactions remotely
- Bypass Play Store security using the “dropper” technique
This malware is especially dangerous because it hides inside apps that appear normal and useful. Once permissions are granted, it quietly takes full control of the device.
Why Trivial Apps Are Risky
Many of the deleted apps abused Android Accessibility Services. This permission is meant to help people with disabilities, but hackers misuse it to gain deep access to devices. Once granted, attackers can monitor screens, steal data, and even control apps remotely.
The lesson is clear: users must carefully check permissions. A document reader or calculator app should not need access to SMS, Accessibility Services, or call logs.
Google Play Protect: First Line of Defense
Google confirmed that Play Protect, Android’s built-in security scanner, blocked many of these malicious apps before they could cause damage. Play Protect works automatically, scanning apps from the Play Store as well as apps downloaded from other sources.
Make sure Play Protect is enabled on your device. Without it, the chances of infection increase dramatically.
The Big Change Coming in 2026
Starting in September 2026, Google will require that all apps come from verified developers in order to run on certified Android devices. This is a major shift in Android’s ecosystem, making it more secure and similar to Apple’s iPhone model.
In practice, this means that sideloading apps from unverified developers will no longer be possible. It will significantly reduce the number of fake or dangerous apps that can spread malware.
How to Protect Your Phone Now
You do not need to wait until 2026 to stay safe. Here are simple steps to protect your Android phone today:
- Delete any apps that are no longer available on the Play Store
- Check permissions and remove apps that ask for unnecessary access
- Keep Play Protect enabled at all times
- Update your phone to the latest version of Android
- Avoid installing apps from third-party stores or unknown websites
Google’s deletion of millions of apps is a reminder that Android malware is a growing problem. The Anatsa trojan shows just how far attackers will go to steal financial data and compromise user security. While Google is taking major steps to protect its ecosystem, users must also take action.
Remove suspicious apps, review permissions, and ensure Play Protect is enabled. With new rules coming in 2026, Android will become more secure, but until then, user awareness is the strongest defense.