Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Hirudo trojan swaps Indonesian bank apps for hooked copies

2 sources · 2 articlesFirst reported Updated ()
What's new

October 22: Reports specify eight Indonesian replacement packages, YAHFA and Dobby hooks, a leaked keybox with revoked certificates, and August backend records.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ThreatFabric says Hirudo uses fake updates to replace eight Indonesian bank apps with copies that spoof integrity checks.

ThreatFabric identified Hirudo, an Android banking remote-access trojan delivered by shopping and entertainment lures including Shopora, 1V1 X, ZoyaTV, and KoiShort. A fake in-app update installs a payload that seeks Accessibility and notification access and can steal credentials, PINs, SMS, and unlock details and view the screen and cameras. For eight Indonesian banking apps at seven banks, it asks the user to remove the genuine app and installs a same-name copy signed with a public Android test key. YAHFA and Dobby hooks falsify certificates and Play Integrity results. A bundled attestation keybox was leaked and at least two certificates were revoked. August 2026 backend data reportedly held thousands of credential and device records; some download routes remained live in September and October 2026.

Key facts
  • A registry lists 42 financial apps, but only eight replacement packages ship.
  • Replacements keep the bank package name and use a public Android test key.
  • YAHFA and Dobby hooks spoof certificates, hide Accessibility, and clear FLAG_SECURE.
  • The bundled attestation keybox was leaked; at least two certificates were revoked.
  • Other credential targets include China, India, Mexico, Morocco, and Thailand.
  • Users must approve uninstall of the real app before the copy can install.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersNames the 42-app registry and live September–October 2026 download routes.
  • Cyber Security NewsAdds country targets, Malaysian checkout branding, and required user approval.
Vendors
Google
Products
Android
Malware
Hirudo
Organizations
ThreatFabric
Countries
IndonesiaChinaIndiaMexicoMoroccoThailandMalaysia

Coverage

oldest first · one row per article · UTC
  1. · 3d ago GBHackersFirst report

    Hirudo Android RAT swaps banking apps using fake updates

    ThreatFabric says lure apps drop Hirudo, which can uninstall genuine Indonesian bank apps and install modified copies that spoof integrity checks.

  2. · 3d ago Cyber Security News

    Hirudo Android trojan swaps real banking apps for hooked copies

    ThreatFabric says replacements are ready for eight Indonesian bank apps and that August 2026 backend data held thousands of credential entries.