New ‘Perseus’ Android malware checks user notes for secrets

Perseus is a new Android banking/infostealer distributed through sideloaded IPTV dropper apps that abuses Accessibility Services to take over devices, capture and stream screenshots, perform HVNC interactions, overlay attacks, keylogging, and uniquely scan popular note-taking apps (e.g., Google Keep, Evernote, OneNote) for passwords and recovery phrases; the campaign targets financial institutions (notably in Turkey and Italy) and cryptocurrency apps and includes strong anti-analysis and evasion checks.