New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

Perseus is a new Android banking malware family built on the Cerberus and Phoenix codebases, designed for device takeover and financial fraud.

• •Distributed via dropper apps disguised as IPTV services on phishing sites, targeting Turkey, Italy, Poland, Germany, France, UAE, and Portugal.
• •Exploits Android Accessibility services to enable real-time remote sessions (VNC/HVNC), overlay attacks, and keystroke capture.
• •Uniquely monitors note-taking apps including Google Keep, Evernote, Samsung Notes, and Microsoft OneNote via a scan_notes C2 command.
• •Calculates a suspicion score from environment checks (Frida/Xposed detection, SIM presence, app count, battery values) before proceeding with data theft.
• •Threat actors likely used an LLM during development, evidenced by extensive in-app logging and emojis found in the source code.