Malware
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
What Happened
ThreatFabric uncovered Hirudo, an Android banking trojan that substitutes eight Indonesian banking apps with custom patched versions. The replacements bypass the apps’ built‑in signature, accessibility, and integrity checks, allowing the trojan to run undetected.
How It Works
Hirudo is distributed through dropper apps such as Shopora, 1V1 X, KoiShort, and ZoyaTV. These apps present legitimate content in a WebView but trigger a fake in‑app update prompt that installs the trojan as a second application. The malware requests its own permissions, sets up a non‑functional VPN to block Internet traffic, and then gains device takeover, credential theft, screen and camera capture, and SMS exfiltration.
Impact
- Credential theft and device compromise for users of the affected Indonesian banks.
- Potential financial loss for customers and banks across Indonesia, China, India, Mexico, Morocco, and Thailand.
- Back‑end infrastructure capable of remote control and data exfiltration.
Mitigation Steps
Defenders should verify the integrity of banking apps, block unauthorized accessibility services, and monitor for suspicious VPN configurations.
Specific actions:
- Validate app signatures against the bank’s official releases.
- Disable or monitor any accessibility services that request notification access.
- Block installation of apps that request a fake in‑app update prompt.
- Use device‑policy controls to prevent installation of unknown VPN profiles.
- Educate users to avoid downloading shopping, adult‑video, or entertainment apps from untrusted sources.
Related vulnerabilities
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
Android RAT Hirudo Replaces Banking Apps with Trojanized Copies
A new Android RAT, Hirudo, drops trojanized copies of banking apps to bypass security controls, targeting eight Indonesian banks and potentially others. Defenders should block suspicious app downloads, monitor for unknown RATs, and enforce app vetting.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing