Perseus Android malware hides in fake IPTV apps, takes over phones and searches private notes
Perseus is Android malware spread through sideloaded IPTV and free-sports streaming apps. It can take over a phone, steal banking logins and search notes apps for passwords and crypto recovery phrases. Don't install APKs from outside Google Play, and keep nothing secret in notes.
Install apps only from Google Play, and don't sideload streaming or IPTV APKs or install apps from social media ads. Don't store passwords or wallet recovery phrases in a notes app. If you installed one, remove it, run Play Protect and change your banking passwords from a different device.
What’s happening
Perseus is Android malware that ThreatFabric described on 19 March 2026. It is spread through sideloaded apps disguised as IPTV and live-sports streaming apps, which people install from outside official app stores. Its installer can get around the restrictions Android 13 and later place on sideloaded apps. Once running, it abuses Accessibility Services to capture the screen, tap and type for an operator, show fake overlays over banking apps and log keystrokes. ThreatFabric says it is the first Android malware it has seen that searches note-taking apps (Google Keep, Xiaomi Notes, Samsung Notes, ColorNote, Evernote, OneNote, Simple Notes) for passwords, wallet recovery phrases and financial details. It targets 17 institutions in Turkey, 15 in Italy, 5 in Poland, 3 in Germany, 2 in France and 9 crypto services. A July 2026 update reported paid Facebook and Instagram ads for a fake RojaDirecta TV app using World Cup branding; one ad reached almost 6,500 users. No total of infected devices has been published. This is a malicious app campaign, not a software flaw, so there is nothing to patch.
- What
- Scam
- Affects
- Android phones running sideloaded IPTV and streaming apps
- Affected
- Android phones where a fake IPTV or streaming app (for example 'Roja Directa TV' or 'RojaDirecta TV') has been sideloaded
- Fixed in
- Nothing to patch
- Since
- 19 Mar 2026
- Closed
- 14 July 2026
Timeline
- Wider attacks
ThreatFabric updated its report to say paid Facebook and Instagram ads were promoting a fake 'RojaDirecta TV' app using FIFA World Cup branding. One malicious ad reached almost 6,500 users.
- Update
BleepingComputer reported the research. It listed the note apps checked (Google Keep, Xiaomi Notes, Samsung Notes, ColorNote, Evernote, OneNote, Simple Notes) and said ThreatFabric had not seen Android malware do this before. It did not report any response from Google.
- Made publicNothing to patch
ThreatFabric published its analysis of Perseus, an Android banking and device-takeover malware spread through sideloaded IPTV-style apps. It targets 17 institutions in Turkey, 15 in Italy, 5 in Poland, 3 in Germany, 2 in France and 9 crypto services, and scans note-taking apps for passwords and recovery phrases.
Sources
- Perseus: DTO malware that takes notesThreatFabric · 19 Mar 2026
- New Perseus Android malware checks user notes for secretsBleepingComputer · 19 Mar 2026