A mass phishing campaign has recently been identified that is utilizing approximately 200 typosquatted domains. Through this campaign, the threat actor responsible is intending to have victims download various Android and Windows malware. Cyble researchers discovered that the domains are being disguised as popular Android application stores and download portals for multiple platforms, utilizing six (6) typosquatted domains. This portion of the phishing campaign is focused on deploying “ERMAAC”, a banking trojan that targets banking accounts and cryptocurrency wallets. BleepingComputer identified a larger portion of the campaign that involves over ninety (90) domains impersonating twenty-seven (27) brands including Google Play, PayPal, Microsoft Visual Studio, TikTok, Notepad+, MetaMask, and more. This portion of the campaign focuses on distributing Windows malware, pushing Android malware, and exfiltrating cryptocurrency recovery keys. Additional malware seen by researchers include the Vidar Stealer information-stealing malware and Agent Tesla keylogger and remote access trojan (RAT). The majority of the identified domains are clones of the legitimate website it is impersonating. Users could be led to these malicious sites through mistyping the domain as well as phishing emails, SMS messages, or social media/forum postings. Examples of the typosquatted domains as well as indicators of compromise (IOCs) can eb reviewed in Cyble’s report linked below.