Cybersecurity researchers have uncovered a new Android banking trojan called Hirudo that targets banking users by replacing legitimate banking applications with modified versions. According to Dutch mobile security company ThreatFabric, the malware changes how banking apps perform their built-in security checks. Researchers identified modified versions of eight Indonesian banking apps, while the malware’s credential-targeting activity spans Indonesia, China, India, Mexico, Morocco and Thailand.
Hirudo is designed to steal login credentials and give attackers remote control over infected devices. It can also capture screen and camera content and steal SMS messages. The malware is distributed through shopping, adult video and entertainment apps that act as droppers, delivering the malicious software as a separate installation package disguised as an in-app update. Some identified apps include Shopora, 1V1 X, KoiShort and ZoyaTV.
The malicious apps may appear genuine because they display real content, such as online stores, video catalogues and short dramas. Behind the scenes, they collect promotional tracking data, retrieve campaign settings and check whether Hirudo is already installed with the required permissions. If it is not present, the dropper displays a fake update prompt to encourage installation. Hirudo must be installed separately and granted its own permissions before it can perform its malicious activities.
One of Hirudo’s most concerning features is its ability to replace a legitimate banking app with a modified copy. It detects installed banking apps, checks their signing certificates and displays a fake update prompt. It then opens the uninstaller for the genuine app and downloads a replacement designed for that particular bank. The modified version contains a hooking engine that interferes with signature verification, accessibility checks, screen-capture protections and Google Play Integrity checks.
Hirudo can manipulate the security information returned by the modified banking app, making it appear more trustworthy than it really is. The malware can return a genuine app’s signing certificate, report an empty list of enabled accessibility services and remove the FLAG_SECURE protection that prevents screens from being captured. It also uses a bundled, publicly leaked keybox for key attestation and relays Play Integrity requests to an attacker-controlled server over plain HTTP. Researchers warn that a valid integrity response alone does not prove an app is untampered.
Researchers say the campaign uses fake websites resembling Google Play Store pages for shopping, entertainment and football apps, with victims potentially directed to them through advertisements on Meta-owned social media platforms. Its backend manages campaigns and stolen information, including device records, lock-screen history and financial profiles containing monthly income and risk-score fields. The discovery highlights how attackers are moving beyond fake login screens to manipulate the banking apps themselves. Users should avoid installing apps or updates from unverified websites and review requested permissions carefully.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
