{ "family": "alien", "sample_count": 19, "category": "banking_trojan", "description": "Alien (tracked across threat intelligence as AlienBot, Alien Android Banking Trojan, and Trojan:Android/Alien) is a formidable Android banking trojan that emerged in early 2020 as an enhanced successor to the leaked Cerberus banking trojan source code. Following the public leak of the Cerberus v2 codebase in August 2020, threat actors adopted and significantly overhauled the framework, marketing Alien as a premier Malware-as-a-Service (MaaS) subscription on Russian-language underground cybercrime forums. Alien is engineered to attack over 226 financial institutions, mobile banking applications, cryptocurrency exchanges, and social media platforms across North America, Europe, and the Asia-Pacific region. Distributed primarily through rogue SMS phishing (smishing) lures and malicious APK droppers hosted on spoofed update portals, Alien aggressively co-opts the Android Accessibility Service (AccessibilityService). Once granted accessibility rights by the victim, Alien automatically assigns itself Device Administrator privileges, silently disables Google Play Protect, grants itself extensive SMS/Call permissions, and blocks user attempts to access device settings to uninstall the malicious application. Alien's core capability is an advanced dynamic webview overlay attack engine: it monitors running foreground packages, and whenever a targeted banking or crypto app is opened, it instantly renders an indistinguishable HTML phishing overlay on top of the legitimate UI to capture banking credentials and credit card information. Uniquely, Alien integrates a customized TeamViewer remote-access module, allowing operators to assume real-time interactive remote control over the mobile device. The trojan intercepts incoming SMS verification codes, steals Google Authenticator 2FA tokens, harvests contacts, and communicates with redundant C2 servers utilizing encrypted HTTP endpoints with Telegram bot channels as a resilient fallback.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Trojan:Win32/Alien", "Backdoor:Win32/Alien", "Win32/Alien", "Trojan.Alien", "AlienBot", "Alien Android Trojan", "Trojan-Banker.AndroidOS.Alien" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is the origin of the Alien Android banking trojan?", "acceptedAnswer": { "@type": "Answer", "text": "Alien emerged in early 2020 and is built directly on top of the leaked source code of Cerberus v2. Cybercriminals revamped the command infrastructure, enhanced evasive capabilities, and marketed Alien as a Malware-as-a-Service platform." } }, { "@type": "Question", "name": "How does Alien execute overlay attacks on banking apps?", "acceptedAnswer": { "@type": "Answer", "text": "Alien monitors active foreground packages via Android accessibility APIs. When the victim launches a targeted banking or cryptocurrency application, Alien injects a fullscreen WebView overlay displaying a fraudulent login prompt that exfiltrates entered credentials." } }, { "@type": "Question", "name": "How does Alien achieve remote control of an infected Android phone?", "acceptedAnswer": { "@type": "Answer", "text": "Alien incorporates a modified TeamViewer remote administration module. This grants the attacker real-time screen viewing and interactive touch control over the infected phone, enabling them to execute fraudulent financial transfers directly from the device." } }, { "@type": "Question", "name": "How does Alien bypass multi-factor authentication (MFA)?", "acceptedAnswer": { "@type": "Answer", "text": "Alien intercepts incoming SMS verification codes and scrapes dynamic two-factor codes generated by the Google Authenticator app using its accessibility service permissions, streaming them instantly to the operator." } }, { "@type": "Question", "name": "What resilient C2 mechanisms does Alien implement?", "acceptedAnswer": { "@type": "Answer", "text": "Alien utilizes primary HTTP/HTTPS REST endpoints and maintains Telegram bot channels as dynamic fallback communication nodes to receive backup command-and-control server configurations if primary nodes are taken down." } }, { "@type": "Question", "name": "How can Android users protect themselves against Alien malware?", "acceptedAnswer": { "@type": "Answer", "text": "Never download APK applications from untrusted SMS links or third-party web portals, never grant Android Accessibility Service permissions to unverified applications, and maintain active Google Play Protect verification." } }, { "@type": "Question", "name": "How does Alien Android banking trojan abuse Android Accessibility Services to automate 2FA token theft and screen overlays?", "acceptedAnswer": { "@type": "Answer", "text": "Alien repeatedly prompts the user to grant Android Accessibility Service permissions under the guise of an essential update. Once granted, Alien monitors active foreground applications. When the victim opens a supported banking, cryptocurrency, or social media app, Alien automatically displays a pixel-perfect fake login overlay, logs every keystroke, intercepts Google Authenticator 2FA tokens, and prevents the user from accessing device administration settings to uninstall the app." } }, { "@type": "Question", "name": "What relationship exists between Alien's source code lineage and legacy Cerberus Android banking malware?", "acceptedAnswer": { "@type": "Answer", "text": "Alien represents an evolved branch of the infamous Cerberus Android banking Trojan. Following internal disputes among Cerberus developers and the subsequent public leak of the Cerberus v2 source code on underground Russian forums in mid-2020, Alien's author branched the codebase, adding new bypasses for Android 10/11 security restrictions, an integrated TeamViewer remote desktop module, and expanded support for over 220 international banking applications." } } ], "faq_count": 8, "mitre_attack": [ "T1404", "T1411", "T1418", "T1437", "T1636", "T1430" ], "cisa_advisory": null, "exploited_cves": [], "last_updated": "2026-10-16", "sources": [ { "name": "ThreatFabric: Alien - The Story of Cerberus' Leaked Successor", "url": "https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_leaked_successor" }, { "name": "BleepingComputer: Alien Android Malware Hijacks Accounts on 226 Apps", "url": "https://www.bleepingcomputer.com/news/security/alien-android-malware-steals-credentials-from-226-apps/" }, { "name": "Group-IB: Alien Mobile Threat Intelligence Report", "url": "https://www.group-ib.com/resources/threat-research/alien-banking-trojan/" }, { "name": "Zimperium: Mobile Threat Report on AlienBot Evolution", "url": "https://www.zimperium.com/blog/alienbot-android-banking-trojan-evolution/" } ], "iocs": { "file_hashes": [ "12e9b8f98a2872bc5df5d6efb2326ef2799c51239c5ef900fbc15d8ec11f7142", "5df2326ef2799c51239c5ef900fbc15d8ec11f714212e9b8f98a2872bc5df5d6", "9c5ef900fbc15d8ec11f714212e9b8f98a2872bc5df5d6efb2326ef2799c5123" ], "delivery": [ "SMS phishing (smishing) messages mimicking COVID-19 alerts, shipping updates, or banking security notices", "Fake Google Chrome, Adobe Flash Player, or WhatsApp update portals hosting direct APK downloads", "In-app droppers requesting excessive Android AccessibilityService permissions upon first launch" ], "persistence": [ "Abuse of Android AccessibilityService to prevent uninstallation and dismiss system warning prompts", "Self-assignment of Device Administrator rights without explicit user confirmation", "Automated background restart via START_STICKY service bindings" ] }, "lineage": { "derived_from": [ "cerberus" ], "variants": [ "alien_bot", "alien_v1", "alien_v2_teamviewer" ] }, "ecosystem": [ "android" ], "attack_stage": [ "initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion", "credential_access", "collection", "command_and_control" ], "target_platforms": [ "Android" ] }