Hirudo Android trojan swaps real banking apps for hooked copies
ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.
68
Organization
ThreatFabric
- Mentions · 7d0
- Mentions · 30d6
- All mentions10
- First seenAug 20, 2026
- Last mentioned8d ago
Timeline
10 articles · newest firstHirudo Android RAT swaps banking apps using fake updates
ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.
68
Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
64
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Hirudo uninstalls real Android banking apps and installs patched copies to steal credentials and bypass security checks.
74
Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with hooked copies that steal credentials and bypass integrity checks.
72
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android trojan replaces Indonesian banking apps with patched copies to steal credentials and control devices.
74
Fake TV Streaming Ads Deliver StreamRat Malware for Remote Android Device Hijacking
StreamRat, a new Android banking trojan, spreads through fake TV-streaming ads on Meta and TikTok.
76
Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
ThreatFabric details StreamRat, a new Android banking trojan spread via Meta malvertising in Spain that reached about 571,000 EU accounts.
55
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
ThreatFabric identified Manic, an Android banking malware and spyware targeting Ukrainian and European financial apps with novel offline Wi-Fi mesh data exfiltration via nearby infected devices.
72
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.
67
Appears with
- Androidproduct · 8
- Hirudomalware · 6
- Googlevendor · 6
- Metaorganization · 3
- ThreatFabricvendor · 2
- Manicmalware · 2
- StreamRatmalware · 2
- TikTokproduct · 1
- Manicproduct · 1
- Ukrainian banksvictim · 1
- StreamRatproduct · 1
- Dobbyproduct · 1
- Miraxproduct · 1
- Cleafyvendor · 1
- GodFathermalware · 1
- Security Affairsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.