{
  "family": "alien",
  "sample_count": 19,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Alien (and its Windows variants) is a highly sophisticated, next-generation banking trojan, operating under a Malware-as-a-Service (MaaS) model. It evolved from the notorious Cerberus trojan codebase and is designed to execute massive financial fraud by stealing credentials, intercepting 2FA, and granting attackers remote control over the infected device.<br><br><b>Understanding Alien</b><br>To the victim, an Alien infection usually begins with a seemingly legitimate app (like a fake COVID-19 tracker or a bogus security update) downloaded outside the official app store. For security analysts, Alien is a top-tier mobile threat. It doesn't just steal data passively; it actively abuses Android's Accessibility Services to act as a remote access trojan (RAT), giving the attacker full UI control to perform fraudulent transactions directly from the victim's device, bypassing location and device-fingerprinting security checks.<br><br><b>Execution and Accessibility Abuse</b><br>Alien is distributed via smishing (SMS phishing) or malvertising (`T1566`). Upon installation, it aggressively requests Accessibility Services permissions (`T1628`). Once granted, it becomes practically omnipotent on the device. It uses these privileges to prevent its own uninstallation, silently grant itself other permissions (like reading SMS for 2FA interception), and monitor the foreground app (`T1056.001`). When a targeted banking or cryptocurrency app is launched, Alien instantly overlays a pixel-perfect fake login screen over the legitimate app (`T1517`) to steal credentials. Furthermore, it includes a TeamViewer-like module allowing the attacker to remotely navigate the device and authorize transfers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total compromise of the device and severe financial loss. IoCs include unexpected prompts requesting Accessibility permissions for unrelated apps. Network logs will show traffic to C2 servers over HTTPS, often utilizing Telegram channels or dynamic DNS for resilience. In enterprise environments, MDM (Mobile Device Management) solutions must alert on the sideloading of unapproved APKs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1517",
    "T1111",
    "T1056.001",
    "T1566",
    "T1628"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1628",
      "name": "Abuse Elevation Control Mechanism: Accessibility Features",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1517",
      "name": "Access Notifications",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the infected mobile device from any corporate networks and Wi-Fi to prevent lateral movement or data exfiltration.",
    "Initiate a remote wipe of the device via MDM if corporate data is at risk; otherwise, instruct the user to perform a hard factory reset.",
    "Force a password reset for all financial, email, and corporate accounts accessed from the device, ensuring the 2FA method is not tied exclusively to SMS on that device.",
    "Review MDM logs to identify the source of the malicious APK (sideloading) and enforce policies blocking installation from unknown sources."
  ],
  "what_to_avoid": [
    "Do not attempt to manually uninstall the app using the standard Android interface; Alien uses its Accessibility permissions to aggressively close the settings menu when uninstallation is attempted.",
    "Avoid trusting SMS-based 2FA during the incident response phase, as the malware actively intercepts and hides these messages."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}