What the ERMAC Source Leak Says About HookBot

This report analyzes ERMAC and HookBot, two closely related Android banking trojans that forked from Cerberus and whose Laravel/React panel and builder source leaked; the leak allowed many operators to stand up panels, increasing short-term activity. The analysis covers code lineage and shared artifacts, attack mechanics (accessibility-based overlays, credential and 2FA theft), the builder and default configuration left in leaked code, panel and builder ports, detection artifacts (favicons, builder obfuscator flags, PROTECTED AREA gate on :50000), observed infrastructure and IoCs (domains, IPs, APK SHA-256s), and operational mitigations like an IP-whitelist security gate and Telegram bot integration.