CYBER 101

  • Alerts
  • Blog
  • Cyber Briefing
  • CyberDecoded
  • CyberReview
  • CyberStory
  • CyberTips
  • Domains
  • FAQ
  • Incidents
  • Tutorials

Subscribe to our newsletter

FOLLOW US

No Result
View All Result
  • Login
  • Register
  • Cyber Citizens
  • Cyber Professionals
  • Institutions
CyberMaterial
  • Events
  • Jobs
  • Vendors
Get Help
  • Cyber Citizens
  • Cyber Professionals
  • Institutions
CyberMaterial
No Result
View All Result
  • Events
  • Jobs
  • Vendors
Get Help
CyberMaterial
Home Alerts

Zombinder APK binding service used in multiple malware attacks

Reading Time: 2 mins read
in Alerts

 

While investigating a new malware campaign targeting Android and Windows systems, researchers at Threat Fabric discovered a darknet service, dubbed Zombinder, used to embed malicious payloads in legitimate Android apps.

The campaign involved the Ermac Android banking Trojan along with desktop malware such as Erbium, Aurora stealer, and the Laplas “clipper”.

This campaign infected thousands of systems, experts reported that the Erbium stealer successfully exfiltrates data from more than 1300 victims.

While investigating Ermac’s activity, the experts spotted an interesting campaign masquerading as application for Wi-Fi authorization. The tainted apps were distributed through a bogus website containing a single page with only two buttons. Clicking on the “Download for Android” button leads to downloading the Ermac malware.

The Ermac variant employed in the attack has the following capabilities:

  • Overlay attack to steal PII
  • Keylogging
  • Stealing e-mails from Gmail application
  • Stealing 2FA codes
  • Stealing seed phrases from several cryptocurrency wallets

Experts also observed threat actors masquerading as malicious apps as browser updates.

The new findings illustrate the threat actor’s continued abuse of Internet Explorer flaws such as CVE-2020-1380 and CVE-2021-26411 to drop backdoors like BLUELIGHT and Dolphin, the latter of which was disclosed by Slovak cybersecurity firm ESET late last month.

Another key tool in its arsenal is RokRat, a Windows-based remote access trojan that comes with a wide range of functions that allow it to capture screenshots, log keystrokes, and even harvest Bluetooth device information.

 

READ FULL ARTICLE

Tags: AlertsAlerts 2022Android appsAurora stealerBanking TrojanDecember 2022ErbiumERMACLaplasMalwareMalware CampaignThreat FabricTrojansWindows SystemsZombinder
ADVERTISEMENT

Related Posts

Flaw exposes 100 Lexmark printer models to hack

Flaw exposes 100 Lexmark printer models to hack

January 27, 2023
CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

January 26, 2023
CISA Releases Eight Industrial Control Systems Advisories

CISA Releases Eight Industrial Control Systems Advisories

January 26, 2023
Trellix automates patching for 62,000 open-source projects

Trellix automates patching for 62,000 open-source projects

January 26, 2023

More Articles

Incidents

Clones flood GitHub to serve malware

August 4, 2022

Veratio podcast: The Impacts Of Insider Threats During COVID-19

April 13, 2022

Vulnerability Scanning 101

November 26, 2021
Quotes

“This regulation helps guarantee…”

March 7, 2022
Document

Ultimate Guide to Cybersecurity Incident Response

April 29, 2022
Book

Hacking Exposed Web Applications, Third Edition

November 9, 2020
Alerts

CISA and FBI Release Alert on Active Exploitation of CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

December 2, 2021
Tool

Digital Impact Toolkit

April 25, 2022
Load More

Security through data

Cybersecurity Domains

  • API Security
  • Business Continuity
  • Career Development
  • Compliance
  • Cryptography
  • HSM
  • KPIs / KRIs
  • Penetration Testing
  • Shift Left
  • Vulnerability Scan

Emerging Technologies

  • 5G
  • Artificial Intelligence
  • Blockchain
  • Cryptocurrency
  • Deepfake
  • E-Commerce
  • Healthcare
  • IoT
  • Quantum Computing

Frameworks

  • CIS Controls
  • CCPA
  • GDPR
  • NIST
  • 23 NYCRR 500
  • HIPAA

Repository

  • Books
  • Certifications
  • Definitions
  • Documents
  • Entertainment
  • Quotes
  • Reports

Threats

  • APTs
  • DDoS
  • Insider Threat
  • Malware
  • Phishing
  • Ransomware
  • Social Engineering

© 2023 | CyberMaterial | All rights reserved.

World’s #1 Cybersecurity Repository

  • About
  • Legal and Privacy Policy
  • Site Map
No Result
View All Result
  • Audience
    • Cyber Citizens
    • Cyber Professionals
    • Institutions
  • Highlights
    • Blog
    • CyberDecoded
    • Cyber Review
    • CyberStory
    • CyberTips
  • Cyber Risks
    • Alerts
    • Attackers
    • Domains
    • Incidents
    • Threats
  • Opportunities
    • Events
    • Jobs
  • Repository
    • Books
    • Certifications
    • Cheat Sheets
    • Courses
    • Definitions
    • Frameworks
    • Games
    • Hardware Tools
    • Memes
    • Movies
    • Papers
    • Podcasts
    • Quotes
    • Reports
  • Report Cyber Incident
  • GET HELP

Subscribe to our newsletter

© 2022 Cybermaterial - Security Through Data .

Welcome Back!

Sign In with Google
Sign In with Linked In
OR

Forgotten Password? Sign Up

Create New Account!

Sign Up with Google
Sign Up with Linked In
OR

All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In

Add New Playlist

This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.