SECURITY researchers have detailed a novel Android banking trojan-and-RAT hybrid termed Hirudo, which stealthily replaces legitimate banking apps with Trojanized copies to undermine security checks from within the target app. Delivered via a dropper embedded in seemingly legitimate apps (such as a shopping, adult video, or short drama app advertised on social media), Hirudo checks if it is already present and then installs itself if not.
The payload currently targets eight Indonesian banking applications, though internal code suggests potential expansion to banks in China, India, Mexico, Morocco and Thailand. In operation, the malware identifies the active Indonesian banking app, presents a fake update prompt, uninstalls the genuine app, and installs a modified bank-specific replacement that contains a hooking engine to bypass security measures inside the host app, including blind signature, Accessibility, screen-capture and Play Integrity checks.
Once active, Hirudo can steal banking credentials, provide live remote control of the device via a full-featured RAT, and capture live video from front- and rear-facing cameras, along with SMS data collection (including a 90-day initial scan and a configured list of bank and wallet senders). The hooking technique conceals itself by substituting the app’s signing certificate and returning an empty list for enabled Accessibility services, effectively hiding the attacker’s controls inside the legitimate app.
ThreatFabric notes that this approach moves tampering from the device level into the target application’s own integrity checks, enabling reusability across apps and regions and complicating detection.
ThreatFabric recommends a fourfold response for financial institutions: verify and enforce Play Integrity server-side, not relying on client-side signals alone; deploy layered defenses with behavioural analytics to flag anomalies; treat Accessibility and screen-capture signals as supporting rather than definitive evidence; and maintain server-side controls for sensitive steps
such as login, credential recovery, beneficiary creation, and payment approvals, since forged local results cannot substitute for server-side decisions.