Perseus Android malware hunts secrets in notes, gains full device control
A new Android banking Trojan named Perseus disguises itself as IPTV apps to distribute via unofficial stores. It uses Android Accessibility Services to scan and extract sensitive data from note apps (Google Keep, Samsung Notes, Evernote, OneNote, etc.), including passwords and recovery phrases, enabling full remote control over infected devices (screenshots, overlay attacks, keylogging, app launches, and more). The malware evades analysis with anti‑analysis checks and a “suspicion score” to decide whether to proceed. It primarily targets Turkish and Italian financial institutions and crypto apps. Users are advised to avoid sideloading APKs, only use Google Play, and keep Play Protect enabled.
