THREATFABRIC researchers have identified a new Android banking trojan, Hirudo, that goes beyond traditional overlays by uninstalling legitimate banking apps and replacing them with patched copies. Once a victim installs a lure app (for example Shopora, 1V1 X, ZoyaTV or KoiShort) hosted on Amazon CloudFront, the malware uses a two‑stage installer: the dropper loads real content in a browser view, then secretly installs the patched banking package after masquerading as an in‑app update.
The replacement app employs a public Android test key, which prevents standard update installation, and uses Accessibility permissions to remove the genuine banking app and guide the user through permission screens to complete the covert replacement.
Inside the patched app, a single injected line loads the YAHFA hooking framework and the Dobby native library; the engine activates via a trigger file on the device and then falsifies internal security checks, including returning the genuine bank certificate when the bank app asks for its signature, omitting active Accessibility service data, stripping screen‑capture protection, and relaying Google Play Integrity checks to an operator server over HTTP.
Beyond app replacement, Hirudo exfiltrates credentials through multiple overlays and overlays a fake checkout flow to harvest payment PINs, while also reading lock‑screen PINs, passwords and patterns via Accessibility. The operator backend claims thousands of stolen credential entries and financial profiles, with live remote control capabilities such as WebRTC live screen streaming and camera activation.
The campaign targets 42 financial apps across Indonesia and other regions, including eight Indonesian banking apps across seven banks, and shows evidence of suspected Chinese‑language backend tooling and activity. Banks should verify Play Integrity verdicts server‑side, bind signals to user sessions, and deploy behavioural analytics; users should avoid social media links and refuse unverified update prompts. The article notes CVE‑related indicators and a broader provisioning of patched app replacements, but attribution remains unconfirmed.