Zscaler’s ThreatLabs team discovered 77 malicious applications on the Google Play Store that accumulated 19 million downloads. These apps, disguised as utilities like PDF readers and flashlight tools, used fake reviews and misleading ads to attract users. Upon installation, they would download a malicious payload, including the Anatsa banking trojan, which overlays fake login screens to steal user credentials. Additionally, the Joker malware was found in 25% of these apps, capable of taking screenshots, accessing device information, and signing users up for premium services without consent. Users are advised to limit app installations, scrutinize reviews, activate Google Play Protect, and consider antivirus applications for enhanced security against malware.