Hirudo Android trojan replaces banking apps to bypass security checks
Hirudo replaces legitimate Android banking apps with patched versions designed to bypass their own security checks, researchers say.
A newly disclosed Android banking trojan is trying to defeat banking-app security from inside the apps themselves. Hirudo replaces legitimate banking apps with patched lookalikes, allowing attackers to interfere with signing, accessibility, screen-capture and integrity checks, according to mobile security company ThreatFabric and reporting by The Hacker News.12
How Hirudo gets onto a phone
ThreatFabric says the operation has targeted users through fake Google Play-style pages and dropper apps presented as shopping, adult-video, entertainment or short-drama services. The dropper loads real-looking content, then displays a fake update prompt that asks the user to install the separate Hirudo payload.12
The malware is not simply hiding inside the original banking app. It checks whether a target app is installed, prompts for the genuine app to be removed, then downloads a bank-specific replacement. ThreatFabric identified patched versions aimed at eight Indonesian banking apps, while the broader credential-theft campaign spans Indonesia, China, India, Mexico, Morocco and Thailand.12
Why the patched apps matter
Hirudo combines credential theft with remote control, screen and camera capture, SMS theft and fake screens for banking and wallet logins. The patched banking apps are designed to return attacker-controlled answers when checking their signing certificate, accessibility services and other security signals.12
ThreatFabric also said the operation can interfere with Android's `FLAG_SECURE` protection and relay Play Integrity requests to an operator-controlled server. That does not mean every integrity response is automatically compromised, but it does mean a valid-looking result should not be treated as proof that an app has not been tampered with.2
The campaign reportedly uses a publicly leaked keybox rather than an operator-created one. ThreatFabric's advice is consequently aimed at defenders: important integrity signals should be checked server-side because locally produced signals can be influenced after an app has been replaced.2
What Android users should do
Do not install updates delivered through a random webpage or an in-app prompt from an unfamiliar app. Keep Google Play Protect enabled, install banking apps through official channels, and treat any request to uninstall a genuine banking app before installing a replacement as a major warning sign. Users who suspect compromise should contact their bank through an official route and follow its account-security advice.12
The hero image is an abstract security illustration rather than a picture of Hirudo. Photo by Towfiqu barbhuiya on Pexels.
Our opinion
Hirudo's most worrying feature is not another overlay or phishing screen; it is the attempt to make a tampered banking app look trustworthy to the checks designed to protect it. That shifts the fight away from spotting a bad interface and towards verifying the app's behaviour from outside the device. It is a useful reminder that a security check performed only by the app being attacked is a weak line of defence.