How fake Android IPTV apps are stealing users’ money and data | Kaspersky official blog
Source Kaspersky Security Blog
Description
We analyze how fake IPTV apps gain control of Android devices, abuse screen access features, and steal credentials, cash, and crypto assets.
Impact
The malware distributed via fake IPTV apps can lead to theft of banking credentials, cryptocurrency assets, and other sensitive personal data. It can hijack device control, capture keystrokes, and exfiltrate screenshots and UI data, enabling attackers to bypass security controls and drain victims' financial accounts. The threat affects Android users who install IPTV apps from unofficial sources, exposing them to financial loss and privacy breaches. There are no known exploits in the wild beyond the described campaigns, but the impact on victims can be significant.
Defensive guidance
Users should avoid downloading IPTV apps from unofficial or third-party stores. Even when using official app stores, carefully review user feedback to detect potential fakes. Installing reputable mobile security software can help detect and block malicious apps. Avoid storing sensitive information such as passwords or recovery phrases in note-taking apps. Use a reliable password manager with encrypted storage for sensitive data. These measures reduce the risk of infection and data theft from such malware.
Summary
Cybercriminals distribute fake Android IPTV apps that masquerade as legitimate or pirated IPTV services to infect devices with malware. The Massiv banking Trojan and Perseus malware strains have been identified using this tactic. Massiv displays fake login windows and records keystrokes to steal banking credentials. Perseus abuses Android Accessibility Services to remotely control devices, capture screenshots, mimic user interactions, and extract sensitive data including passwords and recovery phrases from popular note-taking apps. These capabilities enable attackers to steal money from banking and cryptocurrency accounts. The malware is primarily spread through third-party app stores and targets users in multiple countries, including Portugal, Spain, France, and Türkiye. The threat is heightened around major events like the FIFA World Cup 2026, when demand for IPTV apps surges.
References
Community reviews
Related threats
- ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution VulnerabilityMediumVulnerability
- ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability
- Sleipnir Mobile for Android vulnerable to user interface misrepresentation of critical informationCriticalVulnerability
- Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability
- YuanKong RAT: the Android remote-control service that stamps its operators' names into every buildMalware