Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android trojan replaces Indonesian banking apps with patched copies to steal credentials and control devices.
ThreatFabric disclosed Hirudo, an Android banking trojan delivered by functional shopping, adult-video, and entertainment droppers that prompt a fake in-app update. The second-stage app steals credentials, captures the screen and camera, steals SMS, and supports live device control, with targeting spanning Indonesia, China, India, Mexico, Morocco, and Thailand. For eight Indonesian banking apps it uninstalls the genuine app and installs a patched copy that hooks signature, accessibility, screen-capture, and Play Integrity checks, relaying integrity requests to an operator server. ThreatFabric says victims are lured through fake Google Play-style pages promoted in Meta ads.
- Hirudo is delivered by shopping, adult, and entertainment droppers as a fake in-app update.
- It targets banking credentials in Indonesia, China, India, Mexico, Morocco, and Thailand.
- Replacements for eight Indonesian banking apps hook signature, accessibility, and Play Integrity checks.
- Capabilities include overlays, remote control, screen and camera capture, and SMS theft.
- Distribution uses fake Play-style pages promoted through Meta ads.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036 MasqueradingT1056 Input CaptureT1113 Screen CaptureT1125 Video Capture
- Vendors
- Products
- Android
- Malware
- Hirudo
- Organizations
- ThreatFabric
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.