New Medusa malware variants target Android users in seven countries

Medusa (TangleBot), an Android banking trojan, has re-emerged in mid-2023 with more compact variants that request fewer permissions but retain Accessibility Service abuse, SMS manipulation, contact access, and new commands including black-screen overlays and screenshot capture. Cleafy observed 24 campaigns across five botnets targeting several countries via smishing droppers (fake apps), with C2 URLs retrieved from social media; the changes increase stealth and potential financial theft even though droppers were not observed on Google Play.