Cerberus Android Banking Trojan

Cerberus: Android Banking Trojan Leaked to the Underground and Reused in Modern Attacks

Cerberus is a modular Android banking Trojan that allows attackers to steal credentials, intercept two-factor authentication codes, track keystrokes, and remotely control infected devices. Initially sold via a malware-as-a-service (MaaS) model on underground forums, Cerberus became widespread before its source code was leaked in 2020, leading to a wave of new variants. It remains dangerous due to its extensive capabilities and reuse by low-skilled threat actors.

Introduction to Cerberus

Cerberus abuses Android's accessibility services to automate interactions, record keystrokes, and display fake login overlays over legitimate banking apps. It can forward stolen credentials and OTPs to attackers in real time, enabling full account takeovers. Its MaaS distribution model, paired with a user-friendly control panel, made it accessible to cybercriminals, while the leaked source code ensures continued evolution.

1. How Cerberus Works

Infection Mechanism:
Cerberus is delivered through:

Payload Execution:
Once installed and granted accessibility permissions, Cerberus:

2. History and Notable Campaigns

Origin and Discovery:
Cerberus emerged in mid-2019, advertised on dark web forums as a full-featured Android RAT and banking Trojan. It was developed as a commercial malware offering monthly subscriptions to cybercriminals.

Notable Campaigns:

3. Targets and Impact

Targeted Victims and Sectors:

Consequences:

4. Technical Details

Payload Capabilities:

Evasion Techniques:

5. Preventing Cerberus Infections

Best Practices:

Recommended Security Tools:

6. Detecting and Removing Cerberus

Indicators of Compromise (IoCs):

Removal Steps:

  1. Revoke accessibility permissions from suspicious apps
  2. Use a mobile malware scanner to identify and remove Cerberus
  3. Perform a factory reset if the device remains compromised
  4. Change credentials to any apps accessed on the device
  5. Monitor financial accounts and report suspicious activity

Professional Help:
For high-risk users, such as enterprise employees or victims of financial theft, contact mobile security professionals or your organization’s incident response team for forensic review and device replacement.

7. Response to a Cerberus Infection

Immediate Steps:

8. Legal and Ethical Implications

Legal Considerations:
Cerberus is classified as malware under most national cybersecurity laws. Its use for credential theft and unauthorized access carries serious criminal penalties for distribution and deployment.

Ethical Considerations:
Despite being a commercial offering, Cerberus has been used almost exclusively for malicious purposes. The leak of its source code has fueled a wave of financial cybercrime, illustrating the broader ethical danger of commercial malware development.

9. Resources and References

10. FAQs about Cerberus

Q: What is Cerberus malware?
An Android banking Trojan that steals credentials, bypasses 2FA, and enables remote control of the infected device.

Q: How does Cerberus spread?
Through malicious apps, phishing, fake updates, or dropper apps from unofficial sources.

Q: Can Cerberus steal 2FA codes?
Yes — it intercepts SMS-based OTPs and can screenshot Google Authenticator codes.

Q: Is Cerberus still active?
The original service shut down, but many variants live on, repackaged and reused due to the leaked source code.

11. Conclusion

Cerberus remains a cautionary tale of what happens when commercial malware escapes into the wild. Originally a premium tool for cybercriminals, its leaked code has led to countless clones and attacks. Defending against Cerberus requires a combination of user vigilance, mobile security tools, and strict app permission controls.

 

 

« Back to the Virus Information Library

« Back to the Security Center