Cyble ERMAC Android Malware Increasingly Active

Cyble Research & Intelligence Labs identified a widespread phishing campaign distributing the ERMAC Android banking trojan via typosquatted and fake app-store pages (masquerading as Google Wallet, PayPal, Snapchat, VidMate and others). The malware steals contacts, SMS and the list of installed apps, uses phishing overlays to harvest credentials, communicates with a C2/admin panel, and the report includes multiple IOCs (file hashes, phishing URLs, and IPs) and mitigation recommendations.