Malware
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
What Happened
Hirudo, a new Android malware, has been discovered that replaces legitimate banking applications with malicious clones. The clones disable standard security checks, allowing attackers to capture user credentials and control the device.
Technical Details
Hirudo uses a hooking engine to bypass app‑signature verification, Accessibility services checks, and Google Play Integrity. It substitutes certificate data or returns empty lists, effectively turning the banking app into a credential‑stealing proxy. The malware can also take screenshots, record audio, and exfiltrate messages in real time.
Targets and Delivery
The threat actor has impersonated at least seven Indonesian banks and also targeted institutions in China, India, Mexico, Morocco, and Thailand. Delivery vectors include seemingly legitimate shopping (Shopora), adult (1V1 X), and short‑drama (ZoyaTV, KoiShort) apps that prompt users with a fake “update” dialog and request Accessibility permissions.
Defender Actions
- Verify app signatures against official bank releases and block any app that fails Play Integrity checks.
- Restrict Accessibility services to trusted apps only and audit permission requests on new installs.
- Deploy mobile security solutions that detect hooking engines and anomalous credential‑exfiltration behavior.
- Educate users to avoid installing apps from untrusted categories and to scrutinize update prompts.
Related articles
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing