Rebirth of a Monster: New ‘Perseus’ Android Malware Hunts for Your Private Notes

ThreatFabric researchers uncovered Perseus, a sophisticated Android malware campaign derived from Cerberus and Phoenix that spreads via sideloaded IPTV apps and droppers. Perseus abuses Accessibility Services to enumerate and exfiltrate user notes (including recovery phrases and financial data), supports VNC-like screen capture, overlay credential theft, and remote execution, employs sandbox and realism checks to evade analysis, and is actively observed across Turkey, Italy and other European countries.