Block Fake Banking App Updates to Stop Hirudo Android Trojan
The Hirudo malware replaces legitimate banking apps with patched clones to bypass security checks and steal credentials from users in multiple countries.
Key points
- Hirudo installs as a separate app using fake in-app update prompts from shopping or entertainment droppers.
- The trojan replaces eight Indonesian banking apps with modified versions that hook internal security checks.
- Credential theft targets users in Indonesia, China, India, Mexico, Morocco, and Thailand.
Cybersecurity researchers at ThreatFabric identified a new Android banking trojan named Hirudo that escalates financial fraud by replacing legitimate banking applications with purpose-built patched versions. These modified apps are designed to bypass security checks embedded within the original software, allowing attackers to intercept sensitive data directly from the application process.
The risk
Hirudo facilitates on-device credential theft and live remote control of infected devices. According to ThreatFabric, the malware combines credential theft with device takeover, screen and camera capture, and SMS interception. The operation relies on a fairly mature backend infrastructure to manage these capabilities, enabling operators to view screens and record audio in real time while stealing banking passwords and payment PINs.
Who is exposed
ThreatFabric identified replacements for eight Indonesian banking apps, but the credential targeting spans Indonesia, China, India, Mexico, Morocco, and Thailand. The malware is delivered through shopping, adult video, and entertainment dropper apps. These loaders appear legitimate, loading real content such as storefronts or short dramas in a WebView to maintain user trust while preparing the malicious payload.
Cost and compliance
The malware uses a hooking engine built on open-source frameworks YAHFA and Dobby to bypass app-signature, Accessibility, and Play Integrity checks. ThreatFabric noted that the bundled attestation keybox has been publicly leaked, and Google lists two of its certificates as compromised. This means server-side revocation checks can detect these forgeries, potentially limiting the malware's effectiveness against banks with strict backend validation.
Our take on the response
Security teams should prioritize monitoring for unauthorized Accessibility service grants, as Hirudo requires these permissions to install patched banking apps. Organizations should verify that their mobile security policies block side-loading and enforce strict app signature validation. Relying solely on client-side checks is insufficient given the malware’s ability to hook internal processes.
What defenders should look for
Teams usually detect this activity by monitoring for unexpected requests for Accessibility or notification access permissions, especially after installing entertainment or shopping apps. Check whether legitimate banking apps are being uninstalled and reinstalled without user initiation. Look for network traffic to unknown servers during app launch, which may indicate the hooking engine communicating with an operator-controlled backend. Contain devices by isolating them from the network and revoking suspicious permissions immediately.
What to do and how to stay safe: Hirudo
- Review installed applications for unknown apps that request Accessibility or notification access permissions.
- Verify the integrity of banking apps by checking their signature against official sources.
- Avoid installing updates from within third-party entertainment or shopping applications.
- Enable offline protection features in mobile security software to detect known harmful applications.
Step-by-step guide: Ransomware Myths Debunked: The Hidden Truths About Encryption Attacks
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How is the Hirudo trojan delivered to victims?
It is delivered via shopping, adult video, and entertainment dropper apps that display fake in-app update prompts to install the malware as a second app.
Which banking apps does Hirudo target?
ThreatFabric identified replacements for eight Indonesian banking apps, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.
How does Hirudo bypass security checks?
It uses a hooking engine to substitute certificate information, remove screenshot protection, and modify key-attestation certificates to relay Play Integrity requests through an operator-controlled server.
