Hirudo Android trojan swaps real banking apps for hooked copies
ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.
68
Malware
Hirudo
- Mentions · 7d2
- Mentions · 30d6
- All mentions6
- First seenOct 14, 2026
- Last mentioned3d ago
Timeline
6 articles · newest firstHirudo Android RAT swaps banking apps using fake updates
ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.
68
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
64
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Hirudo uninstalls real Android banking apps and installs patched copies to steal credentials and bypass security checks.
74
Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with hooked copies that steal credentials and bypass integrity checks.
72
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android trojan replaces Indonesian banking apps with patched copies to steal credentials and control devices.
74
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.