New Android Trojan Hirudo Swaps Real Banking Apps for Patched Copies

Cybersecurity researchers have disclosed a new Android banking trojan called Hirudo. It replaces legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself. Dutch mobile security company ThreatFabric said it found replacements for eight Indonesian banking apps, while the malware's credential targeting covers Indonesia, China, India, Mexico, Morocco and Thailand.

The malware is delivered through dropper apps posing as shopping, adult video and entertainment services. These apps load real content, such as a storefront, a video catalogue or short dramas, so they look legitimate. Behind the scenes, the dropper checks whether the Hirudo payload is already installed with its accessibility service and notification access enabled. If not, it shows a fake in-app update prompt to trigger installation. Hirudo is installed as a second app and must be granted its own permissions before it can act. Before installing, it sets up a deliberately non-functional VPN connection to block internet access, which appears aimed at stopping services like Google Play Protect from running cloud-based checks on the payload.

ThreatFabric's Eward Driehuis said the operation combines credential theft, device takeover, screen and camera capture, and SMS theft, backed by a fairly mature backend. The malware enables on-device credential theft and live remote control.