Perseus Android Trojan Hides in IPTV Apps to Steal Credentials and Notes
Summary
Researchers say the Perseus Android trojan is distributed in IPTV apps, primarily targeting users in Turkey and Italy. It uses overlays and keylogging to steal credentials and extracts content from note-taking apps.
Key points
- ThreatFabric researchers say Perseus is actively distributed in apps posing as IPTV services, often sideloaded outside official marketplaces.
- The trojan uses fake login overlays and keylogging to capture credentials as users enter them.
- Perseus scans for apps including Google Keep, Evernote, and Simple Notes, then extracts their stored content.
- Researchers say Perseus primarily targets users in Turkey and Italy.
- The malware incorporates leaked code from older Android banking trojans, including Cerberus.
Article Details
- Event Type
- Discovery and active distribution of the Android trojan Perseus concealed in IPTV-style streaming apps.
- Impact
- Perseus uses overlays and keylogging to capture credentials, including banking data, and extracts content from note-taking apps on infected devices. Researchers report that it primarily targets users in Turkey and Italy.
MITRE ATT&CK
Malware
CerberusPerseus, active in Turkey and Italy, uses overlays, keylogging, and note-extraction—targeting apps like Google Keep and Evernote—and builds on leaked Cerberus code.CrocodilusResearchers note Android banking trojans are evolving, with related threats like Herodotus and Crocodilus using advanced evasion and manipulation techniques.HerodotusResearchers note Android banking trojans are evolving, with related threats like Herodotus and Crocodilus using advanced evasion and manipulation techniques.PerseusResearchers have discovered a new Android trojan called Perseus that hides inside IPTV streaming apps to steal passwords, banking data, and spy on users’ personal notes.
Products
EvernotePerseus, active in Turkey and Italy, uses overlays, keylogging, and note-extraction—targeting apps like Google Keep and Evernote—and builds on leaked Cerberus code.Google KeepPerseus, active in Turkey and Italy, uses overlays, keylogging, and note-extraction—targeting apps like Google Keep and Evernote—and builds on leaked Cerberus code.Simple NotesIt specifically scans for and extracts content from note-taking apps like Google Keep, Evernote, and Simple Notes.
Countries
ItalyPerseus, active in Turkey and Italy, uses overlays, keylogging, and note-extraction—targeting apps like Google Keep and Evernote—and builds on leaked Cerberus code.TurkeyPerseus, active in Turkey and Italy, uses overlays, keylogging, and note-extraction—targeting apps like Google Keep and Evernote—and builds on leaked Cerberus code.