What the Source Leak Says About HookBot

HookBot is an Android banking trojan that evolved from ERMAC and Cerberus, confirmed by source code analysis showing identical database migrations and network protocols. The August 2025 leak of its source code—including the builder, backend, and control panel—enables unrelated operators to deploy HookBot panels using default credentials and keys still present in the code. HookBot enhances ERMAC's capabilities by adding VNC remote control and 38 additional commands. The leaked source also contains a Docker deployment stack, an Obfuscapk builder, and an IP-whitelist firewall that conceals panels but leaves the builder port exposed. Operators target a wide range of financial applications globally, including banks and cryptocurrency wallets. Detection is possible through builder obfuscator flags and favicons, though panel titles can be easily changed to evade detection.

The leak of HookBot's source code allows multiple unrelated threat actors to deploy the malware using default credentials and keys, increasing the likelihood of widespread infections. HookBot's advanced features, such as VNC remote control and numerous commands, enhance its capability for financial theft and unauthorized access. The malware targets a broad spectrum of financial applications worldwide, including banks and cryptocurrency wallets, posing significant risks to users and institutions. The exposed builder port and default credentials increase the attack surface, facilitating easier deployment by malicious actors. Although detection artifacts exist, they can be circumvented, complicating defense efforts.

No official patch or fix is applicable since this is a malware source code leak, not a software vulnerability. Defenders should focus on detection and blocking of known indicators of compromise, including the listed domains, IP addresses, and hashes. Monitoring for use of default credentials and unusual VNC remote control activity on Android devices may help identify infections. Network defenses should consider blocking access to known malicious infrastructure associated with this malware. Organizations should ensure that similar builder or control panel services are not exposed in their environments. Regular updates to endpoint protection and threat intelligence feeds are recommended to detect variants derived from the leaked source.