Researchers find an Android malware strain Cerberus that can extract and steal one-time passwords generated by Google's Authenticator mobile app
Context & Ripple Effects
Cerberus started life as a banking trojan that overlays fake login screens on financial apps; researchers now report it can also pull one-time passwords straight out of Google's Authenticator app, turning the second factor itself into loot. The technique rides on a weakness that has been public since 2014 — researchers detailed in March how Android apps can capture Authenticator's one-time codes via screenshots.
The finding lands in a stretch where every major 2FA channel has been shown attackable on Android: Check Point later tied SMS-code theft to Rampant Kitten's spyware, and Kaspersky's 2025 report showed store-listed apps using OCR to lift crypto wallet recovery phrases from device images. What was pitched as the fix for password theft is increasingly the target.
First-order effects
- Users whose handsets carry Cerberus lose the protection their Authenticator codes were supposed to provide — an attacker with the trojan can read the OTP at generation time, defeating the 'something you have' factor without ever touching the user's password.
- Google's Authenticator shifts from neutral infrastructure to a named attack surface, putting pressure on Google to harden the app against screen-capture and extraction by other apps.
Second-order effects
- Google faces renewed scrutiny of Play Store vetting, the same pressure point behind its removal of 25 apps caught stealing Facebook credentials via phishing overlays — malware families keep reaching distribution despite the review process.
- Security teams evaluating 2FA now have documented theft paths for both major software channels — SMS codes (Rampant Kitten) and authenticator-app TOTP (Cerberus) — weakening the case for either as a default and pushing buyers toward options that don't live on the handset.
Third-order effects
- If code-stealing keeps maturing from proof-of-concept to commodity trojan features, software-delivered one-time passwords get priced out of high-risk accounts, accelerating a structural move toward phishing-resistant authentication such as hardware-bound credentials.
- The pattern across Cerberus, Rampant Kitten, and the OCR wallet-phrase apps points to malware economics shifting from stealing credentials to stealing the factors meant to replace them — making the endpoint OS's app-isolation guarantees, not any single app, the real control point.
The trend: Mobile malware is climbing the authentication stack — from passwords to SMS codes to authenticator-app tokens — eroding each software-based second factor in turn.