● Covered by 3 sources · 3 reportsMedium impact3 negative
Hirudo Android Trojan Replaces Banking Apps to Bypass Security Checks
Key points
- Hirudo replaces legitimate banking apps with patched versions.
- It bypasses app-signature, Accessibility, and Play Integrity checks.
- The malware performs credential theft, device takeover, and screen capture.
- Targets include Indonesia, China, India, Mexico, Morocco, and Thailand.
- Delivered via shopping, adult video, and entertainment dropper apps.
- Hirudo combines credential theft with live remote control.
- Remote control provides live screen viewing via WebRTC.
- Remote control provides remote camera access.
- Remote control provides remote interaction through Android Accessibility Services.
- ThreatFabric tracked and analyzed Hirudo.
- Hirudo targets eight Indonesian banking apps.
- Hirudo displays a fake update prompt.
- Hirudo uninstalls the true app.
New Android Banking Trojan Identified
Cybersecurity researchers have identified a new Android banking trojan, Hirudo, which operates by replacing legitimate banking applications with modified versions. These patched versions are designed to bypass the security checks embedded within the apps themselves, representing an escalation in financial fraud techniques.
ThreatFabric, a Dutch mobile security company, reported the identification of replacements for eight Indonesian banking applications. The malware's credential targeting extends to users in Indonesia, China, India, Mexico, Morocco, and Thailand.
Operational Capabilities
Hirudo's operation involves a combination of credential theft, device takeover, screen and camera capture, and SMS theft. It also features a mature backend for its operations. The malware facilitates on-device credential theft and enables live remote control of infected devices.
The trojan utilizes a hooking engine to disable various security measures, including app-signature, Accessibility, and Play Integrity checks. This is achieved by substituting certificate information or returning empty lists, allowing the malware to operate undetected by these safeguards.
Delivery Mechanism
The Hirudo malware is typically delivered through dropper applications that appear legitimate and offer promised functionality, such as shopping, adult video, or entertainment services. Examples of these dropper apps include Shopora (com.agbbh.kjdrttt), 1V1 X (com.onev.vip), KoiShort (com.koishort.app), and ZoyaTV (com.zoyatv.app).
These dropper apps act as malware loaders, presenting the trojan as a separate installation package or an in-app update. Upon installation, Hirudo requests permissions, including for Accessibility services, and then launches the real banking application.
Impact on Financial Security
The method of replacing legitimate banking apps with compromised versions poses a significant threat to financial security. By bypassing built-in security checks, Hirudo can steal sensitive financial information and allow threat actors to remotely control devices, leading to potential financial losses for users.
The malware's ability to evade common security measures highlights the evolving sophistication of Android banking trojans and the need for users to exercise caution when downloading applications and granting permissions.
Updates
- Hirudo combines credential theft with live remote control.
- Remote control provides live screen viewing via WebRTC.
- Remote control provides remote camera access.
- Remote control provides remote interaction through Android Accessibility Services.
- ThreatFabric tracked and analyzed Hirudo.
- Hirudo targets eight Indonesian banking apps.
- Hirudo displays a fake update prompt.
- Hirudo uninstalls the true app.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A new Android Remote Access Trojan (RAT) named Hirudo replaces legitimate banking applications with trojanized versions to bypass security controls. This malware combines credential theft with live remote control, allowing attackers to view screens and access cameras, representing an escalation in Android banking trojan tactics.
A new Android malware, Hirudo, replaces legitimate banking applications with modified versions to steal credentials and bypass security checks. The malware uses a hooking engine to disable app-signature, Accessibility, and Play Integrity checks, allowing threat actors to remotely control devices and access sensitive financial information.
A new Android banking trojan named Hirudo replaces legitimate banking applications with patched versions to bypass security checks, escalating financial fraud risks. This malware combines credential theft, device takeover, and screen capture, targeting users in Indonesia, China, India, Mexico, Morocco, and Thailand.