Security experts have discovered a new Android malware family named Perseus, which is currently being spread to take over devices and commit financial crimes.

Perseus is based on Cerberus and Phoenix but has evolved into a “more versatile and powerful platform.” It compromises Android devices using dropper apps distributed through phishing websites.

“Using remote sessions that leverage Accessibility services, the malware allows for real-time observation and precise manipulation of infected devices. This enables complete device control and targets different regions, especially Turkey and Italy,” ThreatFabric stated in a report shared with The Hacker News.

“Besides stealing credentials in the usual ways, Perseus also monitors user notes, suggesting an interest in obtaining valuable personal or financial details.”

Cerberus was initially reported by the Dutch mobile security firm in August 2019. The report emphasized the malware’s misuse of Android’s accessibility service to gain extra permissions, steal confidential information, and capture login details by displaying fake overlay screens. After its source code was leaked in 2020, several variations appeared, including Alien, ERMAC, and Phoenix.

Here are some of the artifacts associated with Perseus:

• Roja App Directa (com.xcvuc.ocnsxn) – Dropper
• TvTApp (com.tvtapps.live) – Perseus payload
• PolBox Tv (com.streamview.players) – Perseus payload

ThreatFabric’s investigation revealed that the malware builds upon the Phoenix code, and the developers likely used a large language model (LLM) during development. This conclusion is based on extensive logging within the app and the use of emojis in the code.

Similar to the recently uncovered Massiv Android malware, Perseus disguises itself as IPTV services to target users who want to sideload these apps for watching premium content. The campaigns spreading this malware have mainly focused on Turkey, Italy, Poland, Germany, France, the U.A.E., and Portugal.

“By hiding its malicious code within this expected context, Perseus effectively lowers user suspicion and increases the likelihood of successful infections, blending malicious activity with a typical distribution method for these services,” ThreatFabric explained.

Once installed, Perseus functions similarly to other Android banking malware by launching overlay attacks and recording keystrokes. It intercepts user input in real-time and displays fake interfaces on top of financial and cryptocurrency apps to steal login credentials.

The malware also allows the attacker to remotely control the device through a command-and-control (C2) panel and carry out fraudulent transactions. Some of the supported commands include:

• scan_notes: Captures content from various note-taking apps like Google Keep, Xiaomi Notes, Samsung Notes, ColorNote Notepad Notes, Evernote, Simple Notes Pro, Simple Notes, and Microsoft OneNote (incorrectly specifies “com.microsoft.onenote” instead of “com.microsoft.office.onenote”).
• start_vnc: Starts a near real-time visual stream of the victim’s screen.
• stop_vnc: Stops the remote session.
• start_hvnc: Transmits a structured representation of the UI and allows the attacker to interact with UI elements programmatically.
• stop_hvnc: Stops the remote session.
• enable_accessibility_screenshot: Enables taking screenshots using the accessibility service.
• disable_accessibility_screenshot: Disables taking screenshots using the accessibility service.
• unblock_app: Removes an app from the blocklist.
• clear_blocked: Clears the entire list of blocked apps.
• action_blackscreen: Displays a black screen overlay to hide device activity from the user.
• nighty: Mutes audio.
• click_coord: Performs a tap at specified screen coordinates.
• install_from_unknown: Forces installation from unknown sources.
• start_app: Launches a specified app.

Perseus performs several checks to detect debuggers and analysis tools like Frida and Xposed. It also verifies if a SIM card is present, determines the number of installed apps (and if that number is abnormally low), and validates battery values to ensure it’s running on a real device.

The malware then combines all this information to create a suspicion score, which is sent to the C2 panel to determine the next steps and whether the attacker should proceed with data theft.

“Perseus demonstrates the ongoing evolution of Android malware, showing how current threats build upon existing families like Cerberus and Phoenix, introducing targeted improvements rather than entirely new methods,” ThreatFabric noted.

“Its capabilities, ranging from remote control via the Accessibility service and overlay attacks to monitoring notes, clearly aim to maximize both interaction with the device and the value of the stolen data. This balance between inherited features and selective innovation reflects a broader trend toward efficiency and adaptability in malware development.”