The source code for the ERMAC v3 Android banking trojan has leaked online.
The leak contains code for the trojan itself, but also its builder, backend, and exfil servers.
According to Hunt Intelligence, the code leaked from an open directory.

ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Hunt.io uncovers the complete ERMAC V3.0 source code, revealing its infrastructure, vulnerabilities, and expanded form injection capabilities.

(hunt.io)