top of page
  • bbutler67

This Android Malware Is Stealing Login Credentials

If you're deeply involved in IT security, you may already be familiar with the ERMAC Android banking trojan.

If this is the first time you're hearing of it, be aware that the hackers who authored the malicious code have recently released ERMAC 2.0, which represents a significant upgrade in capabilities from the previous iteration.

ERMAC's main purpose is to steal and send login credentials to the person controlling the code. That person then uses the stolen passwords to take control of a target's bank accounts and/or cryptocurrency wallets and conduct fraud. Or in some cases, simple theft.

Access to ERMAC is subscription based on the Dark Web. The 1.0 version of the malware could be yours for $3k USD per month. This latest iteration is subscription priced at $5k USD per month. Pricey, yes, but those who use it swear by it and are happy to pay.

ERMAC 2.0 was first spotted during a fake Bolt Food application that targeted the Polish market. Bolt Food is a quite legitimate European food delivery service. In this case, the hackers created a fake site that looked convincingly like the real thing and tricked users into downloading what they thought was a food delivery app.

Naturally, it was nothing of the sort, and instead of convenient food service, what the victims got was ERMAC 2.0 and a whole slew of headaches after that.

Although the Bolt Food app was the first, it is by no means the only app that the malicious code impersonates. In fact, according to the latest research, ERMAC 2.0 is currently impersonating nearly five hundred popular Android apps.

In every case however, the campaigns that have been seen so far rely on a user agreeing to download an app from what they believe to be a legitimate third-party vendor site. While it's an undeniably dangerous strain of malware, it is easily avoided simply by sticking to apps on the Google Play Store. Stay vigilant, it's getting dangerous out there.

At Dallas Network Services, we work with a large variety of businesses based in Dallas and Fort Worth (DFW) and the surrounding area such as Addison, Plano, Carrollton, Denton, Richardson, Garland and beyond. We also extend our reach outside the area to include all Texas and other states. We provide on premise server support including Microsoft Exchange as well as Cloud computing services and hosted solutions. We specialize project services, network support, desktop support and voice over IP (VoIP) business phones. Our fully managed IT services will improve your business reliability as well as your bottom line. Contact us today at chat or call 214-696-6630. #DNS#dallasnetworkservices#techsupport#hacker#cybersecurity#MSP

11 views0 comments

Recent Posts

See All
bottom of page