Perseus Android Malware Expands Surveillance by Stealing User Notes

A newly discovered Android malware named Perseus is raising concerns among cybersecurity researchers due to its advanced surveillance capabilities and focus on harvesting sensitive user data, including personal notes. Identified in active campaigns, the malware represents an evolution of earlier banking trojans, combining device takeover (DTO) features with new intelligence-gathering techniques .

Built on Legacy Malware Foundations

Perseus is not entirely new but rather an evolution of well-known malware families such as Cerberus and Phoenix. Researchers note that it inherits core functionalities like overlay attacks, keylogging, and remote control, while introducing refined features aimed at increasing data collection and persistence .

The malware is actively distributed through fake IPTV applications, a tactic designed to exploit user trust in sideloaded apps. These apps often bypass official app store protections, making them an effective delivery vector for malicious payloads.

Advanced Device Takeover Capabilities

Once installed, Perseus gains extensive control over infected devices using Android’s Accessibility Services. This allows attackers to:

• Capture screenshots continuously
• Record user interactions in real time
• Perform remote actions such as clicks, gestures, and navigation
• Launch overlay attacks to steal credentials

In some cases, the malware can create a near real-time visual stream of the victim’s screen, enabling full remote monitoring and control.

New Threat Vector: Note-Taking Apps

One of the most distinctive features of Perseus is its ability to scan and extract data from note-taking applications. Unlike traditional banking malware that focuses only on credentials, Perseus targets apps like Google Keep, Samsung Notes, and Evernote to harvest stored information such as passwords, recovery phrases, and financial details.

This functionality is executed through a command called “scan_notes”, which systematically opens note apps and extracts their contents without user interaction .

Strong Evasion and Anti-Analysis

Perseus includes advanced anti-analysis mechanisms to avoid detection. It performs checks for:

• Root access and debugging tools
• Emulation environments
• Instrumentation frameworks like Frida
• Device realism indicators such as SIM presence and hardware consistency

These checks help the malware determine whether it is running on a real device or within a security research environment.

Targeting and Impact

Campaigns observed so far show a strong focus on Turkey and Italy, with additional activity across Europe and crypto-related platforms. The malware’s ability to combine credential theft, device control, and contextual data harvesting makes it particularly dangerous.

Perseus highlights a growing trend in mobile threats where attackers move beyond simple data theft toward deep behavioral surveillance, exploiting trusted device features to silently extract high-value information.