Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with hooked copies that steal credentials and bypass integrity checks.
ThreatFabric reports Hirudo, an Android banking malware that uninstalls legitimate banking apps and installs patched copies containing a YAHFA and Dobby hooking engine. The hooks spoof app signatures, hide Accessibility services, remove screenshot protection, and relay Play Integrity checks through an operator server. Delivery apps posing as Shopora, 1V1 X, ZoyaTV, and KoiShort prompt victims to grant Accessibility permissions. Hirudo then steals banking passwords, PINs, SMS, screens, and audio, mainly impersonating Indonesian banks while also targeting finance organizations in China, India, Mexico, Morocco, and Thailand. Researchers found thousands of credential entries in an exposed backend, though the victim total is unknown.
- Hirudo replaces legitimate banking apps with patched copies using YAHFA and Dobby hooks.
- Loader apps masquerade as shopping, adult, or short-drama apps and request Accessibility access.
- Hooks spoof signing certificates, hide Accessibility services, and relay Play Integrity checks.
- It steals passwords, PINs, SMS, screenshots, camera access, and audio.
- ThreatFabric found thousands of credential entries; the victim count is unknown.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1036 MasqueradingT1056 Input CaptureT1113 Screen CaptureT1123 Audio Capture
- Vendors
- Malware
- Hirudo
- Organizations
- ThreatFabric
From the original article
2 min read at bleepingcomputer.com
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.