Banking Trojan Disguised as Google Play Update

The Antidot Trojan disguises itself as a Google Play update and uses overlay attacks and keylogging to steal user credentials. It exploits the "Accessibility" service and WebSocket for real-time control. While Google Play Protect can block known versions, this new variant may evade detection. To stay safe, be wary of suspicious apps, check permissions, avoid granting unnecessary Accessibility access, and keep devices and apps updated. Report any unusual behavior to IT promptly.