Loading malware…
Alien is an Android banking trojan operated as a malware-as-a-service offering and widely regarded as a Cerberus-derived malware family or close fork that emerged in 2020. It targets Android devices and combines classic mobile banking-trojan functions with remote-access features, making it suitable for credential theft, account takeover, and on-device fraud. Alien has been associated with campaigns targeting banking applications, cryptocurrency wallet applications, and other financial services, and it became prominent as Cerberus declined after detection pressure and source-code exposure disrupted that ecosystem.
Alien supports overlay-based phishing against targeted applications, keylogging, SMS harvesting and forwarding, contact and device-information theft, application listing, location collection, notification interception, and theft of authenticator-based two-factor authentication material, including Google Authenticator secrets or codes. It also supports remote actions such as application installation, launching and removal, arbitrary web-page display, screen locking, USSD execution, and call forwarding. Reported samples include anti-analysis and resilience features such as app-icon hiding, removal prevention, emulation detection, modular architecture, and auxiliary command-and-control resilience.
Alien has been distributed through staged Android dropper campaigns, including trojanized applications on Google Play masquerading as utilities such as QR scanners, PDF scanners, cryptocurrency tools, and fitness applications. In these campaigns, the initial app typically minimized overtly malicious behavior to evade store review, then fetched configuration or payloads and prompted the victim to install an update or secondary package. Threat reporting also links Alien distribution to dedicated dropper services such as Brunhilda and Gymdrop.
Alien has also appeared in higher-end intrusion chains beyond financially motivated fraud. In 2021 Android exploitation campaigns attributed to government-backed customers of Cytrox, attackers used spearphishing links and zero-day exploit chains to compromise fully updated Android devices, then installed Alien as a precursor component to load the Predator spyware implant. In that role, Alien functioned as the initial Android implant with RAT capabilities used to facilitate deployment of the more advanced surveillance payload.
The malware is part of the broader evolution of Android banking malware away from noisy public MaaS advertising and toward more private, professionalized operations. It is frequently discussed alongside families such as Cerberus, Hydra, Ermac, Medusa, Octo, and Xenomorph, and later Android malware has shown code, naming, or operational ties to Alien. Its combination of banking-trojan theft functions, remote-access capability, and support for webinject-style fraud workflows made it one of the more significant Android financial malware families of its period.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048).
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #2 - Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976).
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #1 - redirecting to SBrowser from Chrome (CVE-2021-38000).
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048).
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #2 - Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976).
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Initially, the Brunhilda droppers were deploying a variety of Android malware applications, like for example samples of the malware family Alien.
The ultimate goal of the operation, the researchers assessed, was to distribute a malware dubbed Alien, which acts as a precursor for loading Predator onto infected Android devices.
Some samples were observed having more than 50.000+ installations, and dropping the android trojan Alien.
Predator от Cytrox / Intellexa работает двухкомпонентно: Alien ломает устройство, Predator устанавливает модули слежки.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php
once clicked, redirected the targets to a rogue domain that dropped the exploits before taking the victim to an authentic site
Web applications remain one of the most common attack surfaces... arbitrary code execution obtained through a web application often serves as the initial foothold. | If we discover a SQL injection vulnerability, we can exploit it using sqlmap... sqlmap.py -u 'YOUR URL' --os-shell
Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php
compromise the system by injecting malicious code into privileged processes
leveraging it to drop a second exploit to escalate privileges and deploy the backdoor
Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php
The code of the Google Authenticator 2FA stealer of the Alien Trojan is visible in following snippet: public final void sniffAuthenticator ( AccessibilityService serv , AccessibilityEvent event , String currPackage )
If you are concerned about WAFs and IDSs, you can enable Event Horizon for evasion.
These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps.
compromise the system by injecting malicious code into privileged processes
Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php
we found that it was signed with a legitimate certificate named SCANDI LLC ... Uncompressing the MSI file unveiled several files ... The first request that the binary sends is: hxxps://datasmetrics.]com/files/Loader_TM.dll
The complete list of features of Alien is as follows: ... Self-protection: Emulation-detection
the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
The complete list of features of Alien is as follows: ... Contact list collection
exec ( 'tasklist /NH /FO CSV' , $outputLines ); ... The core idea is to obtain all running processes from the remote server and compare them against a database of known anti-virus software.
The complete list of features of Alien is as follows: ... Device info collection
The complete list of features of Alien is as follows: ... Self-protection: Emulation-detection
the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
The dropper makes a request towards the C2 sending information about the device, including device ID, device name, locale, country, Android SDK version.
In those newly found samples the authors revisited the C2 communication protocol
Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alien is presented as an offensive security/webshell framework with a plugin architecture that loads and executes payloads across multiple server-side environments, including PHP, ASP, ASPX, and JSP/NebulaPulsar/DarkMatter.
Alien is presented as a webshell/backdoor framework used for post-exploitation. It forwards payloads to the Event Horizon obfuscation framework, which transforms HTTP requests and responses and can generate compatible OneShell payloads with de-obfuscation routines.
A webshell management tool/framework discussed by the author as a client-side tool for interacting with lightweight server-side webshells ("OneShells") and supporting post-exploitation functionality.
An offensive framework/project under which NebulaPulsar is developed as a sub-project for experimenting with multi-platform webshell and implant techniques.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.