A newly documented Android remote-access trojan is replacing legitimate banking applications with patched copies that disable security checks from inside the applications themselves. ThreatFabric, which tracks the malware as Hirudo, said the operation combines credential theft, live device control, screen and camera access, and SMS collection in a campaign currently focused on Indonesia. ThreatFabric’s technical analysis identifies dedicated replacements for eight banking apps spanning seven Indonesian banks.
Hirudo is distributed through seemingly functional shopping and entertainment apps promoted through social media. ThreatFabric identified lures posing as Shopora, 1V1 X, ZoyaTV and KoiShort. After installation, the dropper presents a fake update prompt and delivers Hirudo as a separate APK, seeking Accessibility and notification-access permissions that allow it to automate interactions with the device and monitor activity.
When the malware detects a supported banking app, it checks the installed application and displays another deceptive update request. It then opens Android’s uninstaller for the genuine app, downloads a bank-specific replacement and uses Accessibility features to drive the installation. The substitute retains the original package name and version but is signed with a public Android test key, meaning the real bank application must first be removed. That extra step gives users an opportunity to cancel the attack, but also makes the deception more convincing once the replacement is installed.
The modified applications leave most of the original banking code intact while injecting a self-contained hooking engine built with the open-source YAHFA and Dobby frameworks. According to ThreatFabric, the hooks can return the genuine signing certificate, hide enabled Accessibility services, remove Android’s FLAG_SECURE screenshot protection and relay Play Integrity requests to an operator-controlled server. Those techniques shift the attack from spoofing a banking login screen to manipulating the security decisions made by the banking application itself.
Hirudo’s broader capabilities include phishing for banking passwords and payment PINs, stealing lock-screen secrets, viewing or recording the display through WebRTC, accessing the front and rear cameras, and collecting SMS messages, including an initial scan of up to 90 days. ThreatFabric found a registry of 42 financial applications and credential targets spanning Indonesia, China, India, Mexico, Morocco and Thailand, although only the eight Indonesian apps had dedicated replacement packages in the analysis. The researchers also reported thousands of credential records and device and financial-profile data in an exposed backend, underscoring the potential operational scale of the campaign.
There is no verified CVE associated with Hirudo: it is malware delivered through social engineering and sideloaded applications, not a publicly disclosed vulnerability in Android or a named banking product. Android users should avoid APKs promoted through social-media advertisements, install software only from trusted distribution channels, scrutinize unexpected update prompts and review Accessibility and notification-access permissions. Banks and mobile-defense teams should additionally look for unauthorized app removal and reinstallation, test-key signatures, unexpected sideloading and network connections to the infrastructure documented in ThreatFabric’s report.
