Cerberus (Android Banking Trojan)

What Cerberus Is Used For

Cerberus is a mobile banking trojan, so the core issue is not ordinary app misuse but malicious access to financial accounts through stolen credentials and session material. It is dangerous because it targets the point where a phone becomes a trusted channel for login and transaction approval.

Attackers use that trust to intercept one-time codes, capture credentials and redirect victims into fake prompts that look legitimate. The result is often account takeover rather than simple device infection, which makes the malware especially relevant to banking fraud and mobile identity abuse.

How Cerberus Operates on Android Devices

Its main techniques rely on abusing Android capabilities that were intended to help users and apps. Accessibility abuse can let malware observe screen content, automate taps or suppress warnings, while overlay attacks place convincing phishing screens over real apps to harvest secrets.

This makes the malware effective even when users believe they are interacting with the bank’s own application. The theft path can include credentials, card data, PINs and one-time codes, with the payload often waiting for the user to open a target app before presenting a fake login or approval flow.

In practice, mobile malware of this kind is less about one exploit and more about combining social engineering with device-level trust abuse. The most successful campaigns usually depend on permission abuse, user deception and sustained persistence on the handset.

How Organisations Should Assess Exposure and Contain It

Exposure starts with knowing which devices are used for banking, finance or other sensitive access, and whether those devices are managed, protected and current. A risky device is not just one with malware already on it, but also one that can be tricked into installing apps from untrusted sources, granting powerful permissions or accepting suspicious prompts.

Defenders should treat mobile endpoints as part of the access perimeter and watch for signs such as unusual accessibility grants, overlay behaviour, sideloading, app reputation issues or logins from devices that do not meet policy. Blocking or step-up challenging access from unmanaged or high-risk devices reduces the value of stolen credentials.

For broader context on the family of threats involved, Malware Guide helps place banking trojans, loaders and evasion techniques in the wider malware landscape, while Mobile Malware Guide focuses on Android-specific abuse patterns such as overlays, accessibility misuse and OTP theft.

Detection, Recovery and Identity Impact After Compromise

Detection should look for the behaviours that make this trojan effective, not only for a named malware hash. Suspicious accessibility use, fake login overlays, unknown device administrators, unusual foreground persistence and repeated credential prompts are all consistent with mobile banking trojan activity.

Once compromise is suspected, the impact is often identity-centric: credentials, session tokens, MFA approvals and banking app access may all be exposed. That means remediation is not limited to device cleanup, because stolen secrets can remain valid after the malware is removed.

Post-incident review should therefore include password resets, session revocation, device re-attestation and fraud monitoring for any accounts accessed from the affected handset. Where a bank or service offers risk-based controls, they should be tightened quickly around the affected user, device or network profile.

Risk and Threat Considerations

Cerberus is dangerous because it attacks the trust boundary between a legitimate mobile device and the financial services that trust it. Once a trojan can read prompts, overlay screens and intercept one-time codes, it can convert a single infected phone into a reliable account-takeover path.

Failure mechanism: The malware exploits accessibility services, overlays and phishing prompts to steal credentials and approval factors, then uses them before the victim or bank can recognise the session as fraudulent.

Impact: Organisations can face unauthorised account access, fraudulent transactions, customer harm and a wider loss of trust in mobile authentication flows.

Practitioner Guidance

Why practitioners should care: Banking trojans on mobile endpoints undermine both authentication and fraud controls, so security teams should treat the handset as part of the authentication chain, not just as a user device. Visibility into device posture and app abuse often matters more than signature-based malware checks alone.

What to watch for: Prioritise suspicious accessibility permissions, overlay abuse, sideloaded apps and repeated logins from devices that fall outside managed policy. Those signals are often the earliest practical indicators that a mobile banking trojan is trying to harvest secrets or intercept approvals.

Related resources from NHI Mgmt Group

• What happens when an Android banking trojan is installed on a device used for financial services?
• Android Banking Trojan
• How should Android security teams handle accessibility services abuse in banking and wallet apps?
• How should security teams reduce the risk of Android banking trojans stealing SMS-based authentication codes?