ERMAC Malware Back In Action: New Threats And Attack Methods

Cyble Research Labs details ERMAC 2.0, an Android banking trojan rented on underground forums that targets hundreds of applications (reported 467), spreads via fake Bolt Food and browser-update sites, abuses Accessibility and overlay permissions to inject phishing pages, exfiltrates credentials to C2 servers, and includes APK metadata, manifest and code analysis, MITRE technique mappings, IOCs (file hashes, distribution URLs, C2 IPs), and recommended mitigations.