Novel Android Banking RAT ‘Hirudo’ Targets Mobile Apps
Researchers have uncovered Hirudo, a novel Android remote access banking trojan that uninstalls legitimate banking applications and replaces them with modified versions capable of neutralizing security controls.
Radwan AbdulhadiEditor and technology writer
Overview of the Hirudo Android RAT
A newly detailed mobile threat has emerged that bridges the gap between traditional malware and advanced remote monitoring tools. Security researchers have [analyzed] the Hirudo malware, identifying it as a remote access banking trojan for Android that fuses elements of a classic banking trojan with a full-featured RAT. Rather than relying solely on overlay attacks or simple credential-harvesting screens, the malware performs on-device credential theft alongside live remote control of the compromised phone. Further details are available from SecurityWeek in the original source material.
The operational capabilities of the Hirudo RAT allow threat actors to perform live screen viewing via WebRTC, gain remote camera access, and execute remote interactions through Android Accessibility Services. Furthermore, the malware handles SMS collection, which includes an initial 90-day scan and monitoring via a configured list of target bank and wallet senders.
Delivery Mechanism and Installation Process
The delivery chain for Hirudo typically begins with genuine-looking downloaded content advertised across social media platforms. Users may download what appears to be a harmless shopping app, an adult video application, or a short drama app. Embedded within these applications is a dropper responsible for the next stage of the attack.
Once the victim installs the initial application, the contained dropper checks whether the Hirudo RAT is already present on the device. If the malware is missing, the dropper proceeds to install it, establishing a foothold on the targeted Android device before initiating banking-specific routines.
Replacing Legitimate Banking Apps
The primary payload of Hirudo currently targets eight specific Indonesian banking apps. However, internal code discovered within the malware suggests that its architecture could easily be adapted to target financial institutions and services located in China, India, Mexico, Morocco, and Thailand.
When the malware detects an active Indonesian banking app on a victim's device, it displays a fake update prompt. Following this prompt, Hirudo uninstalls the genuine banking application and downloads its own modified, bank-specific replacement. This approach represents a distinct evolution in mobile banking threat methodologies.
Internal Hooking Engine and Bypassing Security Checks
The modified versions of the banking apps distributed by Hirudo feature an internal hooking engine designed to blind signature, Accessibility, screen-capture, and Play Integrity checks from within the application itself. This technique shifts the point of tampering directly inside the target app.
According to researchers, when the modified app requests Android for its signing certificate, the internal hook substitutes the genuine certificate and hides the test-key signature. Similarly, when the application queries enabled Accessibility services, the hook returns an empty list, rendering the controlling service completely invisible to standard detection mechanisms.
Strategic Significance and Mitigation Advice
Security analysts note that Hirudo marks a deliberate escalation in how Android banking threats approach hardened applications. By moving tampering inside the target app, the operation shifts the conflict from the device level to the application's internal integrity checks, utilizing a reusable engine that can be retargeted at various applications and regions.
To counter these advanced tactics, researchers recommend that financial institutions implement robust, server-side defenses. Play Integrity should be strictly verified and enforced on the backend, as valid verdicts can otherwise be relayed through attacker infrastructure. Additionally, organizations should deploy layered defenses incorporating behavioral analytics, treat Accessibility and screen-capture signals as supporting rather than blocking evidence, and maintain strict transaction-risk controls at critical checkpoints such as login, credential recovery, and payment approval.
Sources
- SecurityWeekNovel Android Banking RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
Continue chronologically
Related stories
Hirudo Android Malware Replaces Banking Apps to Evade Checks
A new Android banking malware named Hirudo steals credentials by replacing legitimate banking applications with modified versions that disable security checks.
Google Details Android October 2026 System Updates
Google details the October 2026 system updates, bringing new features to Play services, the Play Store, and various Android devices.
New Android SMS of Death Exploit Remotely Crashes Phones
A security researcher released a proof-of-concept exploit for an Android SMS of Death flaw that remotely crashes unpatched phones and cellular service.
How to Check If Your Android Phone Still Gets Security Updates
Learn how to check your Android phone's security update status, find manufacturer end-of-life dates, and secure an unsupported device.
