Hirudo Android Malware Replaces Banking Apps to Evade Checks
A newly detailed Android banking malware variant utilizes a hooking engine to replace legitimate financial applications on infected devices, bypassing signature and security checks to steal credentials and remotely control phones.
Radwan AbdulhadiEditor and technology writer
Hirudo Malware Targets Banking Applications
A new Android malware campaign tracked as Hirudo has emerged, focusing on stealing bank account credentials by replacing legitimate banking applications with heavily modified variants that disable built-in security checks. According to a report published by mobile security firm ThreatFabric, the malware targets financial institutions globally, with prominent targeting observed against Indonesian banking apps alongside organizations in China, India, Mexico, Morocco, and Thailand.
Researchers discovered malicious copies of eight banking apps configured to bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists. Security analysts note that this approach marks a notable escalation in how Android banking threats approach hardened software applications.
Loader Apps and Delivery Mechanism
The delivery of Hirudo typically relies on seemingly benign applications distributed through unofficial channels. These include shopping tools like Shopora, adult content apps such as 1V1 X, and short drama platforms like ZoyaTV and KoiShort. These programs appear legitimate and provide their promised user functionality while secretly operating as malware loaders.
Once installed on a victim's device, these loader apps prompt users with fake update notifications that request extensive permissions, including Accessibility services. The malware then initiates a delicate process to launch the genuine banking app's uninstaller, download a patched copy, and leverage its acquired Accessibility permissions to complete the installation of the modified banking app.
Technical Evasion and Hooking Engine
The patched versions of the banking applications retain nearly all of the original app code but load a custom hooking engine built using the open-source frameworks YAHFA and Dobby. As researchers say, running this engine directly inside the banking app's own process allows the software's defenses to be turned against itself.
Upon launch, the modified banking applications execute several distinct evasion actions. They substitute genuine signing certificates when queried, remove built-in screenshot protections to allow remote viewing and recording, and modify key-attestation certificates while relaying Play Integrity requests through an operator-controlled server. However, security experts point out limitations in these evasion methods, noting that Google has listed compromised attestation keyboxes that permit server-side revocation checks to spot the forgeries.
Real-Time Control and Data Exfiltration
When fully active on an infected device, Hirudo grants threat actors extensive remote control capabilities. The malware can harvest banking passwords, payment PINs, device-unlock secrets, and incoming SMS messages. It also supports real-time screen streaming to operators, camera access, and audio recording.
Furthermore, Hirudo features fabricated checkout pages that collect sensitive payment PINs before displaying a fake payment-success message to deceive the victim while data exfiltration occurs behind the scenes. Although thousands of application-credential entries and financial profiles were discovered in an unsecured backend panel, the exact number of compromised victims remains undetermined.
Mitigation and Defensive Recommendations
To counter sophisticated threats like Hirudo, security analysts recommend that financial institutions implement robust server-side validation for integrity and attestation checks, bind these evaluations strictly to active user sessions, and maintain strong behavioral and transaction-risk controls.
Android users are strongly advised to keep their operating systems and applications up-to-date, refrain from downloading APK files from unofficial app marketplaces, and regularly execute Play Protect scans to detect malicious activity early.
Sources
- BleepingComputerHirudo Android malware replaces banking apps to evade security checks
Continue chronologically
Related entity coverage
Related stories
Novel Android Banking RAT ‘Hirudo’ Targets Mobile Apps
A new Android banking trojan named Hirudo combines RAT features with trojanized app replacements to bypass device security checks.
New Android SMS of Death Exploit Remotely Crashes Phones
A security researcher released a proof-of-concept exploit for an Android SMS of Death flaw that remotely crashes unpatched phones and cellular service.
How to Check If Your Android Phone Still Gets Security Updates
Learn how to check your Android phone's security update status, find manufacturer end-of-life dates, and secure an unsupported device.
Android November 2026 Updates Patch Over 200 Vulnerabilities
Google has announced its November 2026 security updates for Android, addressing over 200 vulnerabilities, including a critical remote code execution flaw.
