Hirudo Trojan Replaces Android Banking Apps With Patched Copies
ThreatFabric has detailed Hirudo, an Android banking trojan that replaces legitimate mobile banking applications with purpose-built, patched copies designed to bypass security controls inside the apps themselves. The operation has replacements for eight Indonesian banking apps, while its credential-targeting activity spans Indonesia, China, India, Mexico, Morocco and Thailand.
Hirudo combines on-device credential theft with live remote control. ThreatFabric said its operators can capture screens and camera output, steal SMS messages and collect information used in financial fraud. The campaign is backed by infrastructure that manages campaigns, compromised devices and stolen data, including lock-screen history and financial profiles with monthly-income and risk-score fields.
Functional lures conceal a second malicious app
The trojan is delivered through shopping, adult-video and entertainment dropper apps, including Shopora, 1V1 X, KoiShort and ZoyaTV. These lures load functioning content through a WebView, storefront, video catalogue or short-drama experience, making the app appear legitimate while it prepares the malware installation.
Behind that visible content, the dropper collects promotion-tracking data, retrieves campaign configuration and checks whether Hirudo is already installed with accessibility and notification access enabled. If it is not, the lure presents a counterfeit in-app update prompt. Hirudo is installed as a separate application, so it must receive its own permissions before it can perform its malicious functions.
ThreatFabric also observed an anti-detection measure that configures a deliberately non-functional VPN connection before payload installation. The technique can hinder online reputation and code-analysis checks, although it does not fully disable Google Play Protect because the service also detects known potentially harmful applications offline.
Patched copies target the app's own controls
Like other Android banking malware, Hirudo can show fraudulent payment-PIN, banking-login and lock-screen overlays. Its distinguishing capability is the replacement of an installed banking app with a near-identical tampered version. The RAT identifies a target through accessibility, validates its signing certificate against a stored reference, opens Android's uninstaller for the genuine app and downloads a bank-specific replacement in parallel.
The replacement embeds a hooking engine intended to blind signature, accessibility, screen-capture and Play Integrity checks. It can return the genuine signing certificate, report an empty list of enabled accessibility services and remove the FLAG_SECURE setting so screens can be remotely viewed and recorded.
ThreatFabric said key-attestation certificates are re-signed using a publicly leaked keybox, while Play Integrity requests are sent over plain HTTP to an operator-controlled server that returns a verdict the app accepts. Because the response is relayed rather than genuinely generated, a valid Integrity response alone does not establish that an app has remained untampered.
Server-side checks become essential
Evidence indicates that victims may reach fake Google Play Store landing pages for shopping, short-drama and football applications through advertisements on Meta-owned social platforms. The campaign illustrates how familiar distribution lures can support a more intrusive effort to undermine controls within a trusted application.
For banks and other organisations protecting high-risk Android workflows, the practical implication is to verify sensitive actions server-side rather than relying solely on signals produced locally by the application. Once an attacker can replace an app, its reported signature, accessibility state and integrity verdict may all be attacker-influenced.