Security News > 2021 > September > New Android Malware Steals Financial Data from 378 Banking and Wallet Apps
The operators behind the BlackRock mobile malware have surfaced back with a new Android banking trojan called ERMAC that targets Poland and has its roots in the infamous Cerberus malware, according to the latest research.
"The new trojan already has active distribution campaigns and is targeting 378 banking and wallet apps with overlays," ThreatFabric's CEO Cengiz Han Sahin said in an emailed statement.
Almost fully based on the notorious banking trojan Cerberus, the Dutch cybersecurity firm's findings come from forum posts made by an actor named DukeEugene last month on August 17, inviting prospective customers to "Rent a new android botnet with wide functionality to a narrow circle of people" for $3,000 a month.
Featuring an array of data theft capabilities, the infostealer and keylogger originate from another banking strain called Xerxes - which itself is a strain of the LokiBot Android banking Trojan - with the malware's source code made public by its author around May 2019.
ERMAC, like its progenitor and other banking malware, is designed to steal contact information, text messages, open arbitrary applications, and trigger overlay attacks against a multitude of financial apps to swipe login credentials.
"The story of ERMAC shows one more time how malware source code leaks can lead not only to slow evaporation of the malware family but also bring new threats/actors to the threat landscape," the researchers said.
News URL
Related news
- New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls (source)
- New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers (source)
- New DroidBot Android banking malware spreads across Europe (source)
- New DroidBot Android malware targets 77 banking, crypto apps (source)
- Cyber crooks push Android malware via letter (source)
- SpyLoan Android malware on Google play installed 8 million times (source)
- 8 Million Android Users Hit by SpyLoan Malware in Loan Apps on Google Play (source)
- Germany sinkholes BadBox malware pre-loaded on Android devices (source)
- Germany blocks BadBox malware loaded on 30,000 Android devices (source)
- Android malware found on Amazon Appstore disguised as health app (source)