Malware
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
What happened
Hirudo is a remote‑access banking trojan that installs itself by masquerading as a legitimate shopping or entertainment app. Once installed, it replaces the victim’s banking app with a trojanized version that captures credentials and provides full remote control.
Impact
- Targets eight Indonesian banking apps; code indicates potential use against banks in China, India, Mexico, Morocco, Thailand.
- Steals credentials, logs keystrokes, captures screenshots, and gives the attacker live screen view via WebRTC.
- Can access the device camera and interact through Android Accessibility Services.
What defenders should do
- Block downloads from unverified app stores and enforce strict app‑distribution policies.
- Deploy mobile device management (MDM) solutions that detect and quarantine unknown RATs.
- Implement app‑whitelisting and verify the integrity of banking apps via code signing checks.
- Monitor network traffic for unusual WebRTC or USB‑like connections originating from mobile devices.
- Educate users to avoid installing apps from social‑media links and to verify app authenticity.
Mitigation steps
Use Android Enterprise features to enforce app restrictions, enable device‑level encryption, and keep the OS and banking apps up to date. Consider disabling the Accessibility Services for non‑trusted apps and regularly audit installed applications.
Related articles
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing