Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The complete source code for ERMAC V3.0, an advanced banking trojan, was discovered and analyzed, providing rare insight into this active Malware-as-a-Service platform. ERMAC has evolved to target over 700 financial and cryptocurrency apps, employing sophisticated form injection techniques and encrypted communications. The analysis revealed critical vulnerabilities, including hardcoded credentials and default tokens, which could be exploited to disrupt operations. The malware's infrastructure consists of a Laravel-based C2 backend, React control panel, Golang exfiltration service, and an obfuscated Android backdoor. This comprehensive examination exposes the operational risks of the MaaS model and equips defenders with concrete methods to track, detect, and disrupt active ERMAC campaigns.

ERMAC V3.0 is an advanced banking trojan whose complete source code was leaked and subsequently analyzed, providing rare insight into its Malware-as-a-Service (MaaS) operational model. This trojan targets over 700 financial and cryptocurrency applications, leveraging sophisticated form injection techniques to intercept user credentials and financial data. It employs encrypted communications to evade detection and maintain stealth. The malware infrastructure is complex, consisting of a Laravel-based command and control (C2) backend, a React-based control panel, a Golang exfiltration service, and an obfuscated Android backdoor component. Notably, the source code leak revealed critical operational vulnerabilities such as hardcoded credentials and default tokens within the malware infrastructure, which could be exploited by defenders or attackers to disrupt or hijack the malware operations. ERMAC uses multiple advanced techniques including hooking (T1056.001), encrypted communications (T1071), persistence mechanisms (T1053), credential dumping (T1005), obfuscation (T1027), and user execution (T1204). The MaaS model allows multiple threat actors to deploy customized versions of ERMAC, increasing its threat surface. Although no known exploits are currently active in the wild, the availability of the full source code increases the risk of new variants or attacks emerging. The analysis equips defenders with concrete methods to detect, track, and disrupt ERMAC campaigns by monitoring known indicators such as specific file hashes and IP addresses associated with its infrastructure.

Detailed information about ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis. Get real-time updates, technical details, and mitigatio

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis - Live Threat Intelligence - Threat Radar | OffSeq.com

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis

OSINT -  Roaming Mantis uses DNS hijacking to infect Android smartphones

Roaming Mantis is a malware campaign that leverages DNS hijacking techniques to infect Android smartphones. The attack involves compromising DNS settings, typically on routers or network infrastructure, to redirect users attempting to access legitimate websites to malicious domains controlled by the attackers. Once redirected, Android users are prompted to download and install malware disguised as legitimate applications or updates. This malware can steal sensitive information, including credentials and personal data, or perform other malicious activities on the infected device. The campaign targets Android OS specifically, exploiting the platform's widespread use and sometimes less restrictive app installation policies outside official app stores. The DNS hijacking method allows attackers to bypass traditional detection mechanisms by manipulating network traffic at the DNS resolution level, making it difficult for users to recognize the threat. Although the severity is classified as low in the original report, the technique's stealth and potential for data theft pose a significant risk, especially in environments where users rely heavily on mobile devices for sensitive communications and transactions.

Detailed information about OSINT -  Roaming Mantis uses DNS hijacking to infect Android smartphones. Get real-time updates, technical details, and mitigation st

OSINT -  Roaming Mantis uses DNS hijacking to infect Android smartphones - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Malicious Apps Get Back on the Play Store Just by Changing Their Name

This threat concerns malicious Android applications that manage to reappear on the Google Play Store after being removed, simply by changing their app name. The core issue is that these malicious apps evade detection and removal mechanisms by altering superficial metadata such as the app name, allowing them to bypass automated or manual review processes. These apps typically contain malware designed to compromise user devices, steal sensitive information, or perform unauthorized actions. Although the specific malware variants or payloads are not detailed, the persistence of these apps on the Play Store represents a significant vector for Android users to inadvertently download harmful software. The threat leverages weaknesses in app store vetting processes and the challenges of tracking malicious actors who frequently modify app identifiers to avoid detection. Since these apps are distributed via the official Play Store, users may have a false sense of security, increasing the likelihood of installation and subsequent compromise. The threat level is assessed as low, indicating limited technical sophistication or impact, but the persistence and evasion tactics pose ongoing risks. No known exploits in the wild are reported, and no specific affected versions or patches are identified, suggesting this is an ongoing operational challenge rather than a vulnerability with a direct technical fix.

Detailed information about OSINT - Malicious Apps Get Back on the Play Store Just by Changing Their Name. Get real-time updates, technical details, and mitigati

OSINT - Malicious Apps Get Back on the Play Store Just by Changing Their Name - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - How Mobile Bankbots Disguise as Perfectly Trustworthy Apps

This threat concerns mobile banking malware, commonly referred to as 'bankbots,' which are malicious Android applications designed to steal sensitive banking credentials and financial information from users. These bankbots employ sophisticated social engineering techniques to disguise themselves as legitimate, trustworthy apps, thereby deceiving users into installing them on their devices. Once installed, the malware can intercept SMS messages, capture login credentials, perform overlay attacks on banking apps, and potentially execute unauthorized transactions. The malware's ability to mimic legitimate applications makes detection by end users challenging, increasing the likelihood of successful infection. Although the provided information does not specify particular variants or affected app versions, the threat is characteristic of Android banking malware families that have been active since at least 2017. The lack of known exploits in the wild suggests that this is an intelligence report based on open-source information rather than a newly discovered zero-day exploit. The threat level and analysis scores indicate a moderate concern but with limited immediate exploitation evidence. The malware targets the Android OS platform, which is widely used across Europe, especially on mobile devices. The absence of specific technical details such as command and control infrastructure, persistence mechanisms, or detailed infection vectors limits the depth of technical analysis but does not diminish the relevance of the threat to mobile banking security.

Detailed information about OSINT - How Mobile Bankbots Disguise as Perfectly Trustworthy Apps. Get real-time updates, technical details, and mitigation strategi

OSINT - How Mobile Bankbots Disguise as Perfectly Trustworthy Apps - Live Threat Intelligence - Threat Radar | OffSeq.com

The provided information describes a malware threat categorized under OSINT (Open Source Intelligence) with a focus on Android operating systems. The title "OSINT - Still stealing" suggests ongoing data theft activities, likely involving unauthorized access or exfiltration of sensitive information from Android devices. The malware is identified as targeting the Android OS platform, but no specific affected versions or detailed technical characteristics are provided. The threat level is indicated as 3 (on an unspecified scale), with an analysis rating of 2, and the severity is noted as low. There are no known exploits in the wild, no patch links, and no specific Common Weakness Enumerations (CWEs) associated. The tags emphasize the malware's Android platform focus and its classification as an OSINT-related threat, possibly indicating that the malware is used to gather intelligence or steal data that can be leveraged for further analysis or attacks. The lack of detailed technical indicators or exploit information limits the depth of technical analysis, but the persistent nature of the threat implied by "Still stealing" suggests ongoing risks to Android users from this malware family or variant.

Detailed information about OSINT - Still stealing. Get real-time updates, technical details, and mitigation strategies.

OSINT - Still stealing - Live Threat Intelligence - Threat Radar | OffSeq.com

OSINT - Still stealing

OSINT - Google Discovers New Tizi Android Spyware

The Tizi Android spyware is a form of malicious software targeting Android devices, discovered and reported by Google through OSINT sources. Classified as spyware, Tizi is designed to covertly collect sensitive information from infected devices, potentially including call logs, SMS messages, location data, contacts, and other personal information. Although specific affected versions are not listed, the malware is known to operate on Android platforms. The spyware operates stealthily to avoid detection, enabling persistent surveillance of the victim. The discovery dates back to 2017, and while no known exploits are currently active in the wild, the presence of such spyware indicates ongoing threats to Android users. The technical details indicate a moderate threat level (3) and analysis confidence (2), suggesting some understanding of its capabilities but limited public technical disclosure. The lack of patch links or remediation details implies that mitigation primarily relies on detection and prevention strategies rather than specific software updates.

Detailed information about OSINT - Google Discovers New Tizi Android Spyware. Get real-time updates, technical details, and mitigation strategies.

OSINT - Google Discovers New Tizi Android Spyware - Live Threat Intelligence - Threat Radar | OffSeq.com

The threat described is a category of Android spyware malware identified and classified by CIRCL in 2016. Android spyware is malicious software designed to covertly monitor and collect information from infected mobile devices running the Android operating system. Such spyware typically operates by accessing sensitive data including call logs, text messages, contacts, location data, and potentially audio or video recordings without user consent. The provided information indicates a low severity level and no known exploits in the wild at the time of reporting, suggesting limited active distribution or impact. However, Android spyware remains a significant threat vector due to the widespread use of Android devices globally and the potential for privacy invasion and data exfiltration. The lack of specific affected versions or detailed technical indicators limits the granularity of analysis, but the classification under mobile malware and spyware categories confirms its intent to perform unauthorized surveillance activities. The threat level and analysis scores (3 and 2 respectively) reflect a moderate concern but with limited immediate risk or sophistication documented. Overall, this spyware represents a persistent risk to Android users, capable of undermining confidentiality and user privacy if deployed successfully.

Detailed information about Android spyware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'android malware'

Filter Threats

Threats Tagged 'android malware'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility