Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
New malware bypasses security by uninstalling genuine banking apps and installing tampered versions.
1Sophisticated App Replacement Mechanism
The Hirudo trojan employs a novel strategy by uninstalling legitimate banking applications and replacing them with modified copies. Unlike traditional overlay attacks that merely display fake login screens, this method allows the malware to disable internal security checks from within the application, effectively compromising the integrity of the banking software itself.
2Dropper and Infection Workflow
Hirudo is distributed via deceptive dropper applications disguised as shopping, drama, or adult video platforms. These droppers utilize WebView to display legitimate content, maintaining a facade of authenticity. During installation, some variants intentionally disrupt VPN connections to weaken online reputation checks, facilitating the silent deployment of the malicious banking payload.
3Targeted Banking App Manipulation
The malware maintains a registry of 42 financial apps, with eight Indonesian applications currently targeted for specific replacement. Upon detecting a target, Hirudo triggers an automated uninstallation of the genuine app and downloads a patched version. This replacement is signed with a public test key, necessitating the removal of the original.
4Internal Hooking Engine Integration
Once installed, the modified banking app remains dormant until a trigger file is created. It then activates a hooking engine using YAHFA and Dobby frameworks to intercept Java methods and native functions. This engine manipulates security responses, such as reporting fake signing certificates or hiding active accessibility services from the system.
5Bypassing Integrity and Play Protect
Hirudo circumvents Play Integrity checks by relaying responses through an attacker-controlled server rather than performing genuine verification. Because the keybox used for attestation was publicly leaked and some certificates were revoked, the malware successfully mimics legitimate app behavior, deceiving both the user and the bank's backend security infrastructure during operation.
6Operational Security Failures
The threat actors behind Hirudo left their APK-processing panels and cloud storage buckets exposed without authentication. ThreatFabric researchers discovered thousands of credential entries, device records, and financial profiles dated August 2026. This significant operational security lapse allowed analysts to map the campaign infrastructure, including specific attribution IDs linked to Meta Pixel.
7Server-Side Verification Necessity
The primary defensive takeaway is that locally produced signals from mobile apps are no longer trustworthy. Banks must move security logic to server-side risk scoring rather than relying on client-side checks. If an app can be replaced, its internal reports regarding accessibility or integrity verdicts must be treated as attacker-influenced data.
8Escalation of Mobile Threats
Hirudo represents a deliberate escalation in mobile malware, shifting the battlefield from device-level exploits to the application's internal integrity checks. By utilizing a reusable hooking engine, the operators can easily retarget different apps and regions. This evolution forces a fundamental change in how financial institutions must validate mobile banking sessions.