What the Source Leak Says About HookBot

Reported 25 Aug 2026 by otx · Severity: medium

ERMAC and HookBot are two branches of one Android banking trojan sold as a service, forking from shared code originating with Cerberus. A copy of the builder, Laravel backend, and React panel leaked in August 2025, enabling unrelated operators to deploy panels with default creden