ERMAC V3.0 BANKING TROJAN SOURCE CODE LEAK EXPOSES FULL MALWARE INFRASTRUCTURE

Summary from the TLDR InfoSec newsletter

Complete source code for Android banking Trojan ERMAC 3.0 leaked from an open directory, revealing a Malware as a Service (MaaS) infrastructure targeting over 700 banking, shopping, and cryptocurrency apps. The leak exposed critical security flaws, including hardcoded JWT secrets, static admin tokens, and default credentials in the malware's PHP/Laravel backend and React frontend. ERMAC 3.0 features enhanced form injection methods, AES-CBC encrypted communications, and a Kotlin-based Android backdoor that avoids infecting devices in countries in the Commonwealth of Independent States (CIS).