Cerberus

Cerberus is an Android banking malware operation and malware-as-a-service offering associated with a criminal crew that marketed, rented, and later attempted to sell the full project on a Russian-speaking underground forum. The operation was promoted as a commercial banking trojan service and reportedly offered source code, operator infrastructure, administration components, and customer relationships as part of the sale. The group stated that the crew had split up, indicating Cerberus functioned as an organized cybercriminal enterprise rather than a single standalone malware sample. Cerberus is designed primarily for financial theft from Android users. Its capabilities include banking-notification spoofing to induce victims to submit credentials, theft of authentication material including two-factor authentication codes, and the ability to launch installed applications on infected devices. Reported anti-analysis features include environmental and movement-based checks intended to distinguish real devices from sandboxed or emulated environments, supporting defense evasion. Cerberus was marketed in underground communities as a reliable Android banking trojan and was rented to other criminals for sustained use, indicating an operator-and-customer model consistent with financially motivated cybercrime.