New Perseus Android Banking Malware to Extract Sensitive Data
Security analysts have identified a new Android malware family, Perseus, that is actively spreading in the wild to take over devices and commit financial fraud.
Perseus is constructed on the legacy of older strains such as Cerberus and Phoenix, but the operators have extended that base into a more modular and capable platform. The malware is typically delivered by dropper applications served from phishing pages.
Perseus leverages Accessibility-driven remote sessions to observe victims in real time and to interact precisely with an infected handset, enabling full device takeover. So far, the campaigns have concentrated heavily on users in Turkey and Italy.
Beyond stealing account credentials, the malware also actively scans note-taking applications to extract sensitive personal and financial information stored there, indicating an emphasis on high-value data.
Cerberus similarly abused Android’s accessibility service to acquire extra privileges and used fake overlay screens to harvest credentials. After Cerberus’s source code leaked in 2020, numerous offshoots like Alien, ERMAC, and Phoenix appeared, and Perseus now advances that lineage.
Researchers also note that Perseus appears to build on the Phoenix codebase and that its authors may have leaned on a large language model during development - an inference drawn from unusually verbose in-app logging and even emoji usage in the source.
Perseus disguises itself as IPTV applications to entice users who sideload third-party players to stream premium content. Distribution efforts have been observed across Turkey, Italy, Poland, Germany, France, the U.A.E., and Portugal.
Embedding malicious code inside plausible IPTV packages lowers user suspicion and raises infection rates. Once resident on a device, Perseus operates like other Android banking malware: it deploys overlay attacks and records keystrokes to capture inputs in real time, then shows fake screens on top of banking and cryptocurrency apps to phish credentials.
The operators control infected phones through a command-and-control (C2) panel and can execute or authorize fraudulent operations.
To avoid analysis and to decide whether a device is worth exploiting, Perseus runs multiple environment checks. It looks for debuggers and inspection frameworks such as Frida and Xposed, verifies SIM card presence, inspects the number of installed apps (flagging unusually low counts), and checks battery-related values to confirm execution on a real handset.
All gathered indicators are combined into a suspicion score that the malware reports to its C2 server; that score helps determine if the attacker should proceed with data theft or other actions.