Hirudo Android trojan swaps real banking apps for hooked copies
Original title: New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks
ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.
ThreatFabric identified Hirudo, an Android banking trojan that tries to uninstall a genuine banking app and install a same-name, same-version copy signed with a public test key. The copy uses YAHFA and Dobby hooks to spoof the bank certificate, hide Accessibility services, clear FLAG_SECURE, and relay some Play Integrity checks. Lures such as Shopora, 1V1 X, ZoyaTV, and KoiShort push a second package through a fake update. Operators can collect passwords, PINs, SMS, and unlock details and view the screen and cameras.
Unconfirmed: ThreatFabric’s account of backend records and target lists is the researchers’ reporting; victim banks are not named.
- Prepared replacements cover eight Indonesian banking apps from seven banks.
- Credential targets also include China, India, Mexico, Morocco, and Thailand.
- Fake checkout pages carry Malaysian bank and wallet branding.
- The bundled attestation keybox was publicly leaked, and at least two certificates are revoked.
- Users must approve uninstall of the real app before the copy can install.
Impact: Theft of banking credentials, PINs, SMS, and remote device control
| Product | Affected |
|---|---|
| Google Android | — |
- 1.Do not install app updates from outside the official store or grant unneeded Accessibility access.
- 2.Do not uninstall a banking app at the request of an unfamiliar app.
- 3.Banks should verify Play Integrity and certificate revocation on their own servers.
- Vendors
- Products
- Android
- Malware
- Hirudo
- Organizations
- ThreatFabric
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | com.koishort.app | 8ec79c0b0333c009b KoiShort lure and dropper, casino route — com.koishort.app SHA-256 d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb |
| domain | com.onev.vip | 789db40fe4a53b1b4523383a945328b7 1V1 vip lure and dropper — com.onev.vip SHA-256 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec7 |
| domain | com.zoyatv.app | ab9fce2fd5fdceea01eb54296c2f47b4d ZoyaTV lure and dropper — com.zoyatv.app SHA-256 425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b37 |
| domain | d21gcldn8gp80l.cloudfront.net | t[.]net/apk-fortress/latest.apk 1V1 X download route Domain d21gcldn8gp80l[.]cloudfront[.]net KoiShort casino download route Domain dydjjnnjg7jeb[.]c |
| domain | d3q4tlm7pw29zr.cloudfront.net | cloudfront[.]net KoiShort short-drama download route Domain d3q4tlm7pw29zr[.]cloudfront[.]net Download host for patched banking apps IPs and port 134 |
| domain | d3s06yhcwfnwcx.cloudfront.net | Play Integrity relay used by four patched apps Domain/path d3s06yhcwfnwcx[.]cloudfront[.]net/apk-fortress/latest.apk 1V1 X download route Domain d21 |
| domain | dydjjnnjg7jeb.cloudfront.net | 0l[.]cloudfront[.]net KoiShort casino download route Domain dydjjnnjg7jeb[.]cloudfront[.]net KoiShort short-drama download route Domain d3q4tlm7pw29 |
| domain | jiekou.baojingtextile.cn | os[.]com Lure registration and channel configuration Domain jiekou[.]baojingtextile[.]cn RAT configuration API IP and ports 134[.]122[.]153[.]13 |
| domain | www.helloharmonyos.com | 3fb85e492b99 Hirudo RAT v7.8.166 — com.r9nkvx.qw2mpl Domain www[.]helloharmonyos[.]com Lure registration and channel configuration Domain jiek |
| ipv4 | 134.122.153.136 | ou[.]baojingtextile[.]cn RAT configuration API IP and ports 134[.]122[.]153[.]136:8085 , :18085 HTTP API endpoints IP and ports 134[.]1 |
| ipv4 | 134.122.153.68 | t[.]net Download host for patched banking apps IPs and port 134[.]122[.]153[.]68:8080 , 134[.]122[.]153[.]92:8080 APK-processing panel |
| ipv4 | 134.122.153.92 | tched banking apps IPs and port 134[.]122[.]153[.]68:8080 , 134[.]122[.]153[.]92:8080 APK-processing panels IP 18[.]139[.]79[.]161 APK |
| ipv4 | 18.139.79.161 | 8:8080 , 134[.]122[.]153[.]92:8080 APK-processing panels IP 18[.]139[.]79[.]161 APK source host and app-management console Note: IP a |
| ipv4 | 43.225.157.157 | s 134[.]122[.]153[.]136:1883 , :1884 MQTT broker URL hxxp://43[.]225[.]157[.]157:8766/request_token Play Integrity relay used by four |
| sha256 | 0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 | f0248 Shopping lure and dropper — com.agbbh.kjdrttt SHA-256 0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 1V1 vip lure and dropper — com.onev.vip SHA-256 2e45277acfd |
| sha256 | 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b | 83a945328b7 1V1 vip lure and dropper — com.onev.vip SHA-256 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b KoiShort lure and dropper, casino route — com.koishort.app |
| sha256 | 425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83 | 96c2f47b4d ZoyaTV lure and dropper — com.zoyatv.app SHA-256 425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83 Hirudo RAT, July build — com.zk7qpx.mv9wlt SHA-256 b2270c29 |
| sha256 | b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99 | 78004c83 Hirudo RAT, July build — com.zk7qpx.mv9wlt SHA-256 b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99 Hirudo RAT v7.8.166 — com.r9nkvx.qw2mpl Domain www[.]helloh |
| sha256 | d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d | t lure and dropper, casino route — com.koishort.app SHA-256 d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d ZoyaTV lure and dropper — com.zoyatv.app SHA-256 425cd7072b |
| sha256 | f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248 | s of compromise (IoCs):- Type Indicator Description SHA-256 f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248 Shopping lure and dropper — com.agbbh.kjdrttt SHA-256 0097a |
| url | http://43.225.157.157:8766/request_token | nd ports 134[.]122[.]153[.]136:1883 , :1884 MQTT broker URL hxxp://43[.]225[.]157[.]157:8766/request_token Play Integrity relay used by four patched apps Domain |
From the original article
5 min read at cybersecuritynews.com
A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim’s genuine banking app and install a modified copy in its place. The replacement keeps the bank app’s name and version, but contains extra code designed to interfere with security checks. Instead of relying only […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.