Hirudo Android RAT swaps banking apps using fake updates
Original title: Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions
ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.
ThreatFabric describes Hirudo, an Android banking remote-access trojan delivered by shopping and entertainment lures including Shopora, 1V1 X, ZoyaTV and KoiShort. A fake in-app update installs the payload, which seeks Accessibility and notification access, then can steal credentials, PINs and SMS and view the screen. For eight Indonesian banking apps at seven banks, it prompts removal of the genuine app and installs a hooked replacement. Some download routes were still live in September and October 2026.
Unconfirmed: Credential-volume figures come from ThreatFabric's review of captured backend data, and the operators are not named.
- Hirudo keeps a registry of 42 financial apps but ships eight replacement packages.
- Replacements keep the bank package name but are signed with a public Android test key.
- Hooking uses YAHFA and Dobby to falsify certificates and Play Integrity results.
- A bundled attestation keybox was leaked and at least two certificates were revoked.
- Backend data from August 2026 reportedly held thousands of credential and device records.
Impact: Stolen banking credentials, PINs, SMS and remote phone control
- 1.Do not install APKs prompted inside shopping or entertainment apps, especially if they request Accessibility.
- 2.If a banking app disappears or is replaced, do not sign in and contact the bank through a verified channel.
- 3.Banks should verify Play Integrity server-side and check attestation revocation.
- Vendors
- Products
- Android
- Malware
- Hirudo
- Organizations
- ThreatFabric
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | com.koishort.app | 77acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b com.koishort.app KoiShort lure and dropper (casino route) Note: IP addresses |
| domain | com.onev.vip | 0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 com.onev.vip 1v1 vip lure and dropper 2e45277acfde3fb704179476b08f428f66 |
| sha256 | 0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 | c8fc3ef583f0248 com.agbbh.kjdrttt Shopping lure and dropper 0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 com.onev.vip 1v1 vip lure and dropper 2e45277acfde3fb704179 |
| sha256 | 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b | 53b1b4523383a945328b7 com.onev.vip 1v1 vip lure and dropper 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b com.koishort.app KoiShort lure and dropper (casino route) N |
| sha256 | f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248 | bank through a verified channel. IOCs SHA-256 Package Role f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248 com.agbbh.kjdrttt Shopping lure and dropper 0097a0406be2054 |
From the original article
4 min read at gbhackers.com
Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone. Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself. Hirudo uses a two-app setup.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.