Hirudo Android Trojan Swaps Banking Apps for Their Own Patched Copies

Dutch mobile security firm ThreatFabric has disclosed a new Android banking trojan called Hirudo. Its hallmark is replacing legitimate banking apps with purpose-built, patched versions that defeat security checks from inside the app itself. Researchers describe it as a fresh escalation in financial fraud.

The team found replacements for eight Indonesian banking apps, while the malware's credential targeting spans Indonesia, China, India, Mexico, Morocco and Thailand. According to ThreatFabric's fraud engineering VP Eward Driehuis, the operation combines credential theft, device takeover, screen and camera capture and SMS theft, backed by a fairly mature backend.

How infection works

Hirudo is delivered through dropper apps for shopping, adult video and entertainment — among them Shopora, 1V1 X, KoiShort and ZoyaTV. The lure is functional: a WebView loads real content, a storefront, a video catalogue or short dramas, so the experience looks legitimate. Meanwhile the dropper checks whether the trojan is already installed and, if not, shows a fake in-app update prompt to trigger its installation. Notably, Hirudo is installed as a second app and must be granted its own permissions.

To hinder cloud-based checks, including Google Play Protect, the malware blocks Internet access through a deliberately non-functional VPN connection before installing the payload. ThreatFabric assesses this is more about reducing the effectiveness of online reputation and code analysis than fully disabling Play Protect.

Swapping the banking app

The standout trick is replacing the banking app with a tampered copy. The RAT detects the installed bank via accessibility, checks its signing certificate against a stored reference, shows a fake update prompt, opens Android's uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.

A hooking engine embedded in the copy blinds the internal checks: it returns the genuine signing certificate, returns an empty list when queried for enabled accessibility services, and strips the FLAG_SECURE flag so screens can be viewed and recorded remotely. Play Integrity requests are relayed over plain HTTP to an operator-controlled server that hands back the desired verdict. ThreatFabric stresses that the attestation keybox the engine ships is not the operators' own but a publicly leaked one, and that a valid Integrity response alone no longer proves an app is untampered.

The malware spreads via fake pages impersonating Google Play, with users funneled there by ads on Meta's social platforms. The lesson for defenders is blunt: once an app can be replaced, its locally produced signals — signature, accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.

Source: The Hacker News