Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...we already observed operating one of the Ermac forks, "MetaDroid", as well as using Hook and Octo mobile malware.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
Once the mobile device of the victim has been compromised, the bad actors can intercept OTP codes, incoming SMS messages, and phone calls... operators execute various commands to manage the victim and to perform actions on their devices for further successful theft ("Get SMS list", "Send SMS" or "Forward Call", for example:- when interacting with the bank’s validation systems to confirm transaction or OTP code).
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modern Android banking malware with advanced webinject capability, able to use multiple injects simultaneously against banking platforms for credential theft and fraud enablement.
An Ermac fork reportedly operated by the threat actor sybra.
An Ermac-source-code fork/botnet with minor differences, such as removal of locale checks for CIS countries.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.