MEDUSA

Description

Medusa is an Android banking trojan that steals credentials from financial applications and performs overlay attacks that display fake login screens over legitimate apps. It abuses accessibility services to read screen content, intercept notifications, and defeat text based verification codes, and its operators rent it out as a service to other criminal crews. Campaigns against banks across Europe and North America have grown steadily, and its modular updates continue to expand its data theft features.

Stats

First seen

February 2023

Last seen

October 2026

MITRE ATT&CK techniques

4 techniques across 2 tactics.

Associated groups

• G1048UNC3886

Associated campaigns

• C0056RedPenguin

Alert name variants