Perseus Android Malware Uses Accessibility to Take Over Devices and Steal Notes
Summary
Threat Fabric details Perseus, Android malware distributed through IPTV-themed apps. It uses Accessibility for remote control, credential theft, and note collection, and checks devices for analysis tools. A July 2026 update reports renewed delivery through social ads.
Key points
- Perseus builds on Cerberus and Phoenix code, with English and Turkish branches that differ in class naming and functionality.
- Campaigns use IPTV-themed apps and droppers to distribute the malware; observed targets include users in Turkey and Italy.
- Accessibility-based commands let operators view screens, interact with apps remotely, and support fraudulent transactions.
- The scan_notes command opens supported note-taking apps and records their contents, which may include sensitive personal or financial information.
- Perseus uses overlays and keylogging to capture credentials and user input.
- Anti-analysis checks look for Frida, Xposed, root indicators, emulators, debuggers, and other suspicious device characteristics.
- A July 2026 update reports a campaign using paid Facebook and Instagram ads to promote a fake RojaDirecta TV app to Italian users.
Article Details
- Attack Vectors
- Perseus was distributed through IPTV-themed applications masquerading as streaming services, including APK sideloading.
- A dropper was used to bypass Android 13+ restrictions on sideloaded applications.
- A July 2026 campaign used paid Facebook and Instagram ads promoting a fake RojaDirecta TV app to Italian users.
- Defensive Notes
- The report describes Perseus as checking for root access, debuggers, Frida and Xposed, emulator fingerprints, and other indicators of an analysis environment.
- The report recommends awareness of IPTV-themed applications distributed outside official marketplaces and fake streaming advertisements.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1ea8360c4d3b7ccea50e9f19630be9d23df26ac713799e2f8457520c0d29bdda | SHA-256 hash of the Perseus dropper identified as Roja App Directa. |
| SHA256 | 2524e9d5ed1e55332fe2d1cc0e7ad4e2656ad5ca624199e6f619325979b3529a | SHA-256 hash of the Perseus payload, English fork. |
| SHA256 | 56d3bb5e8771b41b11d368e70ddd26fe6f1e7bd00b3aafcfd4c34ef62f87093d | SHA-256 hash of the Perseus payload, Turkish fork. |
MITRE ATT&CK
T1411Perseus uses overlay attacks to present fake interfaces and capture credentials.T1417.001Perseus uses Accessibility Services to capture screenshots and monitor user interactions, including keylogging.T1430Perseus systematically opens note-taking applications and records contents of users' notes.T1476Perseus was distributed through IPTV-themed dropper applications and, in a later campaign, a fake streaming app promoted through social-media ads.T1513Perseus transmits compressed screenshots to its C2 server during screenshot-based remote sessions.T1628.001Perseus detects analysis environments by checking for root indicators, debuggers, instrumentation frameworks, and emulator characteristics.
Malware
Cerberusthe continued evolution of mobile malware, building upon the code base of earlier families such as Cerberus and Phoenix, and advancing into a more flexible and capable platform for device compromise.ERMACThe underlying code is based on Cerberus, a long-standing malware family that has served as the foundation for several others, such as Ermac and Phoenix, following the leak of its source code in 2020.KlopatraThe specific dropper application used to distribute Perseus is not unique to this malware family, but has been observed distributing also other malware families, such as Klopatra and Medusa.Medusawell-known “creatures” of the Android malware underworld) and showing connections to operations involving Medusa, this variant feels less like a lone warrior and more like the product of a full mythological crossover.PerseusThe threat is called Perseus, and represents the continued evolution of mobile malware, building upon the code base of earlier families such as Cerberus and Phoenix, and advancing into a more flexible and capablePhoenixevolution of mobile malware, building upon the code base of earlier families such as Cerberus and Phoenix, and advancing into a more flexible and capable platform for device compromise.
Products
AndroidThe Mobile Threat Intelligence Team has identified a new Android threat actively distributed in the wild.FacebookRojaDirecta lure resurfaces via Facebook adsFridaStrong Anti-Analysis Measures: Extensive environment checks, including detection of tools like Frida, highlight a clear focus on evading analysis and maintaining operational secrecy.Google Play ServicesGoogle Play Services presence — verifies whether Play Services are installed, since their absence can indicate a non-standard or analysis environment.Google Play StoreIPTV applications are widely used and often distributed outside of official marketplaces such as the Google Play Store, making users more accustomed to sideloading APK files and less likely to question non-standardInstagramA campaign active from 5 July 2026 ran Meta ads (Facebook and Instagram) for a fake "RojaDirecta TV" app, targeting Italian users aged 25-65+ with the familiar pitch - all the football, live, senza registrazione, senzaXposedDynamic analysis / instrumentation tools — looks for tools such as Frida and Xposed.