New Cerberus Android Malware Variant Evades Security Tools: Cyble

Cyble researchers discovered "ErrorFather," a retooled Cerberus Android banking trojan using a multi-stage dropper, native decryption (libmcfae.so + rbyypivsnw.png), Telegram-based C2, and a DGA to deliver a decrypted.dex payload that performs overlay phishing, keylogging, VNC remote access, and PII theft; approximately 15 samples and active C2 activity were observed and the final payload bypassed VirusTotal detection.