ThreatFabric Uncovers Perseus Android Malware

Cybersecurity researchers at ThreatFabric have identified a new Android malware family known as Perseus, which disguises itself as streaming applications to steal sensitive user data, including passwords and financial details stored in personal notes. The malware, actively distributed through unofficial app sources, primarily targets devices in Turkey and Italy, according to a report released Thursday.

Perseus spreads via dropper apps masquerading as IPTV services, which users often download to access pirated live sports and television content. These apps are typically sideloaded from third-party websites or unofficial stores, bypassing the Google Play Store and its security checks. Once installed, the malware requests access to Android's Accessibility Services, a feature intended to assist users with disabilities but frequently abused by threats to gain broad control over the device.

The malware's distinctive capability involves systematically scanning notetaking applications for high-value information. It opens apps such as Google Keep, Evernote, Microsoft OneNote, Samsung Notes, Xiaomi Notes, ColorNote, and Simple Notes, then extracts text containing passwords, cryptocurrency...