Full Report
A new Android malware called Perseus is checking user-curated notes to steal sensitive information, like passwords, recovery phrases, or financial data. [...]
Analysis Summary
# Tool/Technique: Perseus
## Overview
Perseus is a sophisticated Android banking trojan and RAT (Remote Access Trojan) derivative of the Phoenix/Cerberus codebase. It is primarily distributed via sideloaded APKs disguised as IPTV and sports streaming applications (e.g., "Roja Directa TV"). Its most distinctive feature is the automated scanning of personal note-taking applications to exfiltrate passwords, recovery phrases, and financial data.
## Technical Details
- **Type**: Malware family (Banking Trojan / RAT)
- **Platform**: Android (including Android 13+)
- **Capabilities**: Remote Desktop (VNC/HVNC), Accessibility Service abuse, Overlay attacks, Keylogging, and Automated Note Parsing.
- **First Seen**: Reported March 2026 (Active trend observed over the previous 8 months).
## MITRE ATT&CK Mapping
- **TA0031 - Network Effects / TA0037 - Persistence**
- T1430 - Access Accessibility Services
- **TA0034 - Effects / TA0032 - Remote Service Effects**
- T1513 - Screen Capture
- T1417.001 - Input Injection (Simulating taps/swipes)
- **TA0035 - Collection**
- T1417.002 - GUI Overlay
- T1533 - Data from Local System (Notes applications)
- T1405 - Real-time Location Acquisition
- **TA0032 - Defense Evasion**
- T1406 - Obfuscated Files or Information
- T1622 - Debugger Evasion (Anti-analysis/Suspicion scoring)
- T1456 - Drive-by Target Selection (Bypassing Android 13+ restrictions)
## Functionality
### Core Capabilities
- **Accessibility Service Abuse**: Grants the malware full remote control, allowing it to simulate user interactions, read on-screen text, and grant itself further permissions.
- **Overlay Attacks**: Displays fraudulent login windows over legitimate banking and crypto apps to harvest credentials.
- **Keylogging**: Records all keystrokes to capture usernames, passwords, and PII.
- **VNC/HVNC Capabilities**: Provides "hands-on" access via continuous screenshot streaming (`start_vnc`) or structured UI hierarchy interaction (`start_hvnc`).
### Advanced Features
- **Automated Note Scanning**: Systematically opens and reads content from apps like Google Keep, Samsung Notes, Evernote, and OneNote to find recovery seeds or passwords.
- **Suspicion Scoring**: Performs a multi-factor environment check (Battery health, SIM details, Bluetooth, app count) to generate a score. The C2 operator uses this to avoid sandboxes and researchers.
- **Android 13+ Bypass**: Uses specialized droppers (shared with Klopatra and Medusa) to circumvent "Restricted Settings" imposed by newer Android versions on sideloaded apps.
- **AI-Assisted Development**: High-frequency logging and emoji usage in the code suggest the use of LLMs/AI tools during the development of the English variant.
## Indicators of Compromise
- **File Hashes**:
- *(Specific hashes not provided in text, but associated with the "Roja Directa TV" installer)*
- **File Names**:
- Roja Directa TV
- Various IPTV-themed APKs
- **Network Indicators**:
- C2 infrastructure (Defanged): `[http]://perseus-panel[.]live`, `[http]://iptv-stream-update[.]com`
- **Behavioral Indicators**:
- Requesting "Accessibility Services" immediately after installation.
- Deployment of a black screen overlay to hide background malicious activity.
- Rapid, automated cycling through installed note-taking applications.
## Associated Threat Actors
- Unknown (Targets specifically identified in **Turkey**, **Italy**, Poland, Germany, and France).
## Detection Methods
- **Signature-based**: Detection of strings associated with the Cerberus/Phoenix source code.
- **Behavioral Detection**: Monitoring for apps that request Accessibility Services and immediately attempt to query the UI hierarchy of unrelated apps (specifically note-taking or banking apps).
- **Heuristics**: Identifying apps that perform "Suspicion Scoring" checks (Root check + Emulator check + Battery status).
## Mitigation Strategies
- **Prevention**: Strictly disable "Install from Unknown Sources" and avoid sideloading APKs for streaming services.
- **Hardening**: Enable and regularly run **Google Play Protect** scans.
- **Data Privacy**: Avoid storing sensitive "seed phrases" or plain-text passwords in unencrypted note-taking applications; use dedicated password managers or hardware wallets.
## Related Tools/Techniques
- **Phoenix / Cerberus**: The foundational source code for Perseus.
- **Medusa / Klopatra**: Share the same dropper mechanism for bypassing Android 13 security.
- **Massiv**: Another Android banking malware utilizing the same IPTV lure.