Hirudo Android trojan swaps real banking apps for patched copies

Hirudo, an Android banking trojan detailed by ThreatFabric in an October 14 report, does something most Android bankers don't: instead of overlaying a fake login screen on the real app, it uninstalls the genuine banking app and replaces it with a patched copy carrying a code-hooking engine. The primary source is ThreatFabric's write-up; BleepingComputer's Bill Toulas covered it the same day.

How it works

Hirudo arrives inside apps that look legitimate — a shopping app (Shopora), an adult-content app (1V1 X), and short-drama apps (ZoyaTV, KoiShort) — which act as loaders. Each shows a fake "update" prompt that walks the victim through permission grants, including Accessibility.

With Accessibility in hand, the malware:

1. Launches the real banking app's uninstaller, then downloads and installs a patched copy of that app.
2. Keeps most of the original code but loads a hooking engine built on the open-source YAHFA and Dobby frameworks.
3. Substitutes the genuine signing certificate, hides the enabled Accessibility services, removes screenshot protection, and modifies key-attestation certificates — relaying Play Integrity requests through an operator-controlled server to fake a clean device.

Once resident, Hirudo can steal banking passwords, payment PINs, device-unlock secrets, and SMS messages, stream the screen, and access both cameras. Fake checkout pages harvest payment PINs and then display a fabricated "payment successful" result.

What's affected

ThreatFabric identified copies of eight banking apps and says Hirudo impersonates at least seven Indonesian banks, with Indonesia the current focus. The report also lists financial organizations in China, India, Mexico, Morocco, and Thailand as targeted. The victim count is unknown — but ThreatFabric found thousands of application-credential entries in an unsecured operator backend panel, alongside device, lock-screen, and financial-profile data.

There is no CVE here; this is a social-engineering plus permission-abuse chain, not a platform vulnerability. The defense is operational, not a patch.

Action checklist

1. Install Android apps from Google Play only. The loaders here are sideloaded shopping/drama/adult apps that request an "update" — that flow is the tell.
2. Treat any app's request for Accessibility as a red flag. A shopping or media app has no legitimate need for it. Deny, and uninstall the app that asked.
3. For banking-app publishers: enforce server-side Play Integrity verification and do not trust the device-reported verdict. Hirudo relays integrity requests through its own server precisely to defeat client-side checks.
4. Check key-attestation revocation server-side. ThreatFabric notes the bundled attestation keybox has been publicly leaked and Google lists two of its certificates as compromised, so a server checking revocation can catch the forged attestations.
5. For affected regions, watch for a banking app that was "reinstalled" or updated outside the Play Store, requests Accessibility, or shows an unexpected signing certificate.

Context

Hirudo is the latest entry in a steady run of Android financial malware that leans on Accessibility abuse — see our coverage of preinstalled Android malware and the Android framework zero-day on the KEV list. The app-replacement technique is the notable escalation: by shipping a modified-but-functional copy of the real bank app, Hirudo keeps the victim inside what looks like their genuine banking experience while the hooking engine lifts everything they type. That it also actively forges Play Integrity and attestation — rather than merely hiding — shows how far commodity Android bankers have moved up the anti-detection curve. The leaked keybox is the one break defenders get: revocation still works if it's checked where the malware can't reach.