New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

ThreatFabric disclosed a new Android banking/DTO malware family named Perseus that evolves Cerberus/Phoenix functionality to steal credentials, monitor notes, and perform real-time accessibility-based remote control. Distributed via dropper apps masquerading as IPTV services and observed targeting Turkey, Italy and other countries, Perseus supports overlay attacks, VNC/HVNC-like remote sessions, numerous C2 commands, environment anti-analysis checks, and lists several app package artifacts used in campaigns.