Loading story…
ERMAC evolved into a more capable Android banking trojan that abuses Accessibility Services to steal credentials, intercept SMS codes, and capture Google authentication tokens, allowing attackers to bypass multi-factor authentication and take over banking, financial, ecommerce, and cryptocurrency accounts. Researchers said ERMAC 2.0, derived from leaked Cerberus code and sold through the malware-as-a-service ecosystem, expanded its targeting from 378 applications to 467 and used encrypted communications, phishing overlays, and app-list reconnaissance to fetch tailored injection content from command-and-control servers.
The malware was distributed through fake browser update pages, phishing sites impersonating brands such as Bolt Food, trojanized Android apps, and Google Play dropper applications that helped infect more than 300,000 devices across multiple banking trojan campaigns. ThreatFabric also linked ERMAC delivery to the Zombinder app-binding service, which hides malicious payloads inside working Android apps, and observed overlapping infrastructure that also pushed Windows malware including Erbium Stealer, Laplas Clipper, and Aurora Stealer, underscoring a broader criminal ecosystem built around outsourced obfuscation, staging, and malware delivery.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
ThreatFabric reported that the same infrastructure distributing Ermac also offered Windows malware through a 'Download for Windows' option. The Windows chain delivered Erbium Stealer, Aurora Stealer, and Laplas Clipper, and ThreatFabric observed more than 1,300 Erbium victims.
ThreatFabric analyzed a campaign using the Android payload-binding service it named Zombinder to distribute Ermac through fake websites and trojanized legitimate apps. The modified apps remained functional while covertly prompting victims to install malware.
ThreatFabric identified the Brunhilda group as distributing Ermac and Hydra through trojanized apps on Google Play, including a QR code creator app. The droppers registered devices with command-and-control infrastructure and then downloaded payload packages after profiling victims.
ERMAC was first discovered in late August 2021 as an Android banking trojan targeting Polish users. It was built from leaked Cerberus malware code and initially supported credential theft from hundreds of applications.
In 2021, ThreatFabric reported that Google Play dropper campaigns distributing Ermac, Anatsa, Alien, and Hydra infected more than 300,000 devices over a four-month span. The droppers masqueraded as legitimate apps and used staged delivery to evade review and detection.
Intel 471 described ERMAC as a mature malware-as-a-service operation that abuses Android Accessibility features for overlay attacks and can bypass MFA by stealing Google authentication and SMS tokens. The report also linked ERMAC promotion to DukeEugene and associated some bot infrastructure with Yalishanda bulletproof hosting.
Cyble Research Labs reported that ERMAC 2.0 was being rented on underground forums for $5,000 per month and delivered through fake websites, including a Bolt Food lure and fake browser update pages. The report said version 2.0 expanded targeting from 378 applications in ERMAC 1.0 to 467 applications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 178 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourcethreatfabric.com
Open sourceblog.cyble.com
Open sourcethreatfabric.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Researchers reported that the Android banking trojan **Aberebot** evolved into a new variant called **Escobar**, a malicious app disguised as trusted software such as Google Chrome and McAfee. The malware targets customers of more than **140 banks and financial institutions across 18 countries**, while also phishing for credentials tied to services including **PayPal**, **Gmail**, **MobiKwik**, and **Unocoin**. Earlier Aberebot samples used phishing pages hosted from a GitHub repository and relied on **Telegram** bot infrastructure for command-and-control and data exfiltration. Escobar significantly expands the original malware's capabilities beyond banking theft by abusing Android accessibility and other dangerous permissions to steal **Google Authenticator** codes, intercept **SMS** and OTPs, monitor notifications, harvest contacts, call logs, files, and location data, and remotely control infected devices through **VNC**. The malware can also record audio, take photos, send SMS messages, inject web pages, uninstall apps, delete itself, and enumerate device and network information consistent with mobile discovery behavior such as **MITRE ATT&CK `T1421`**. Researchers said the malware was heavily obfuscated, actively developed, and advertised on a cybercrime forum, indicating continued investment by its operators.
Aug 15, 2026
Researchers and Italy’s CERT-AGID reported that the Android banking trojan **Oscorp**, later tracked as **UBEL**, was distributed through a malicious APK site in Italy and evolved into a broader global campaign targeting more than 150 applications, including banking apps. The malware abused Android’s **Accessibility Service** to gain extensive control over infected devices, repeatedly coercing victims to grant accessibility, usage statistics, battery optimization exemptions, and sometimes device administrator privileges to maintain persistence and expand access. Once active, UBEL/Oscorp could steal credentials through phishing overlays rendered in a `WebView`, intercept SMS messages, place calls, trigger call forwarding, execute USSD requests, launch or remove apps, and block legitimate applications. Analysts also documented screen and audio capture via **WebRTC/STUN**, HTTP POST communications with command-and-control servers, and specialized theft functions including replacement of cryptocurrency wallet addresses and harvesting of Google Authenticator one-time codes; published indicators included malware hashes, package names, C2 domains, injection paths, and AES keys tied to the operation.
Aug 15, 2026