Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis

hunt.io | blog | #credential-theft | #android | #ermac | #banking-trojan | #malware-as-a-service | #source-code-leak

Summary

Hunt.io obtained the full ERMAC V3.0 source code, exposing critical weaknesses like a hardcoded JWT secret and expanded form injection targeting 700+ financial and crypto apps.
Published
Collected

original ↗

Related coverage

blog · wiz.io
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.
blog · hunt.io
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66
Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
blog · hunt.io
Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight
A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.
blog · hunt.io
GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains
GreenSpot-linked infrastructure spoofs NetEase 163.com with a malicious login page and fake download pages on domains registered hours apart via a reseller, to steal credentials.
blog · hunt.io
Exposing Massive Phishing Scams Abusing Cloudflare Services
One shared Font Awesome kit helped Hunt.io uncover 60,000+ phishing links on Cloudflare Workers and IPFS gateways, mostly fake Microsoft SharePoint/Office365 logins plus DHL and webmail lures.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back