THREATFABRIC researchers have detailed a new Android banking trojan named Hirudo that goes beyond overlaying fake screens by replacing targeted banking apps with modified copies. Instead of presenting a counterfeit login, Hirudo uninstalls the legitimate app and installs a patched replacement that quietly disables the bank’s security checks from inside the app.
Eight Indonesian banking apps, across seven banks, already have dedicated replacements, with the malware’s credential-stealing logic aimed at users in Indonesia, China, India, Mexico, Morocco, and Thailand.
Hirudo is delivered via a second dropper app that masquerades as a legitimate service such as a shopping, drama platform, or adult video app. It loads real content through a WebView and, on detecting a banking app, shows a fake in‑app update prompt and proceeds to install the patched banking app in parallel. The dropper can deliberately break the device’s VPN during installation to hinder analysis and Google Play Protect, though not fully bypassing it.
The replacement keeps the original package name and version but is signed with a public test key, meaning Android will not treat it as an update from the bank. The trojan hooks into the banking app with a small code change, enabling a built-in engine (YAHFA and Dobby) that falsifies security checks, hides accessibility permissions, and allows screen capture. Play Integrity responses are relayed via the operator’s server, and local signals from patched apps are considered attacker-influenced.
The operation uses cloud‑hosted distribution, campaign tracking, and exposed credentials, with thousands of credential records observed in August 2026.