CYBERSECURITY researchers have disclosed Hirudo, a new Android banking trojan that escalates fraud by replacing legitimate banking apps with patched versions designed to defeat built‑in security checks from inside the app itself. ThreatFabric says eight Indonesian banking apps were targeted, with the malware delivering credential theft, device takeover, screen and camera capture, and SMS theft through a mature backend.
The dropper distribution method involves shopping, adult, and entertainment apps that present a convincing fake in‑app update prompt to install Hirudo as a second app, which must then obtain its own permissions to enact malicious activity.
Hirudo operates by installing a hijacked, tampered banking app that embeds a hooking engine to block the target app’s security checks, including accessibility services, screen capture, and Play Integrity verifications. The attacker’s code can impersonate the original app’s signing certificate, manipulate enabled accessibility service lists, and strip the FLAG_SECURE flag to allow remote viewing and recording of screens.
Evidence from ThreatFabric notes the campaign uses a non‑functional VPN to blunt cloud‑based detection before payload installation and relays Play Integrity results via plain HTTP to an operator server, meaning a valid integrity response does not guarantee an untampered app. The operation also collects device data, lock‑screen history, and financial profiles, and the payload can deliver fake screens to harvest PINs and credentials, while enabling total remote control.
Analysts emphasise that the unique feature is swapping the target app with a patched copy rather than merely abusing the device, enabling broader reuse against other apps and regions.