Android users are targeted in a phishing campaign that will infect their devices with the Anubis banking Trojan that can steal financial information from more than 250 banking and shopping applications. The malware mainly targets banking and financial applications, but also looks for popular shopping apps such as eBay or Amazon. The Trojan has a keylogger module that can capture keystrokes from every app installed on the compromised Android device. Anubis is also capable of encrypting files on the internal storage and from external drives using the RC4 stream cipher.
Source: https://www.bleepingcomputer.com/news/security/phishing-attack-disables-google-play-protect-drops-anubis-trojan/