Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Hirudo uninstalls real Android banking apps and installs patched copies to steal credentials and bypass security checks.
ThreatFabric detailed Hirudo, an Android banking trojan that uninstalls genuine banking apps and installs patched copies rather than overlaying fake login screens. Droppers disguised as shopping, short-drama, or adult apps show fake updates; one creates a broken VPN that cuts internet access during installation to weaken online checks. Eight Indonesian apps from seven banks have replacements that use YAHFA and Dobby to spoof signatures, hide accessibility services, permit screen capture, and relay Play Integrity over HTTP. Credential theft also targets China, India, Mexico, Morocco, and Thailand, and an unauthenticated operator panel exposed thousands of August 2026 credential records.
- Replaces genuine banking apps instead of showing fake login overlays.
- Eight Indonesian apps from seven banks have dedicated replacements.
- Also targets users in China, India, Mexico, Morocco, and Thailand.
- Hooks spoof certificates, hide accessibility services, and relay Play Integrity.
- Exposed operator panel held thousands of August 2026 credential records.
From the original article
5 min read at securityaffairs.com
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.