Privacy Ninja

New ERMAC 2.0 Android Malware Steals Accounts, Wallets from 467 Apps

New ERMAC 2.0 Android Malware Steals Accounts, Wallets from 467 Apps

The ERMAC Android banking trojan has released version 2.0, increasing the number of applications targeted from 378 to 467, covering a much wider range of apps to steal account credentials and crypto wallets.

The goal of the trojan is to send stolen login credentials to threat actors, who then use them to take control of other people’s banking and cryptocurrency accounts and conduct financial or other forms of fraud.

ERMAC is currently sold to members of darknet sites at a subscription rate of $5,000 per month, which is $2k over the price tag of the first version, reflecting the upgrade in features and its popularity.

ERMAC sold on hacker forums
ERMAC sold on hacker forums (ESET)

Fake Bolt Food app

The first malware campaign utilizing the new ERMAC 2.0 malware is a fake Bolt Food application targeting the Polish market.

Also Read: 12 Benefits of Data Protection for Business Success

According to ESET researchers, the threat actors distributed the Android app through the “bolt-food[.]site” website, impersonating the legitimate European food delivery service. This fake site is still up at the time of this writing.

Users likely end up on the fake site via a phishing email, malicious social media posts, smishing, malvertising, etc. If they download the app, they are met with a permission request that demands complete control of their device.

Permissions requested upon installation
Permissions requested upon installation

Granting access to the Accessibility Service is required to serve the application overlays, tricking the victim into entering their credentials on forms that look legitimate but are just clones of the actual application interfaces.

Cyble has sampled the malware for a deeper technical analysis and confirms that it grants itself 43 permissions upon installation (via Accessibility), including SMS access, contact access, system alert window creation, audio recording, and full storage read and write access.

Targeting a galore of apps

ERMAC first determines what applications are installed on the host device and then sends the information to the C2 server.

The response contains the injection modules that match the application list in encrypted HTML form, which the malware decrypts and stores into the Shared Preference file as “setting.xml.”

Response from the C2 containing the injections
Response from the C2 containing the injections (Cyble)

When the victim attempts to launch the real application, the injection action occurs, and a phishing page is loaded on top of the actual GUI. The harvested credentials are sent to the same C2 that provided the injections.

Also Read: Privacy policy template important tips for your business

The injection that takes place on the device
The injection that takes place on the device (Cyble)

The commands supported by ERMAC 2.0 are the following:

  • downloadingInjections – Sends the application list to download injections
  • logs – Sends injection logs to the server
  • checkAP – Check the application status and send it to the server
  • registration – Sends device data
  • updateBotParams – Sends the updated bot parameters
  • downloadInjection – Used to receive the phishing HTML page

The banking apps targeted by EMAC 2.0 include institutions worldwide, making the app suitable for deployment in many countries. Moreover, popular cryptocurrency wallets and asset management apps are stolen too.

Cyble’s analysts have found many similarities to the “Cerberus” malware, so it appears that the second version of the powerful trojan is based on it.

The extensive list of apps supported make this a potent malware, but it’s worth noting that it would stumble into problems in Android versions 11 and 12, thanks to the additional restrictions that Google added to prevent Accessibility Service abuse.

To prevent infections from Android trojans, avoid downloading APKs from outside the Play Store, especially from websites you haven’t confirmed as legitimate.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us