Hirudo, a newly analyzed Android banking trojan, can replace legitimate banking apps with modified versions that hide security checks while stealing credentials and giving attackers remote control of infected phones.
Cybersecurity firm ThreatFabric identified the malware, which combines banking fraud capabilities with remote access tools. It can view a victim’s screen in real time, access the front and rear cameras, interact with the device and collect SMS messages.
The malware spreads through dropper applications disguised as legitimate shopping, adult video or short drama apps. These apps may reach users through social media advertisements. Once installed, the dropper checks for Hirudo and installs the malware if it is not already present.
Hirudo currently targets eight Indonesian banking apps. Its internal code also suggests potential targeting of financial institutions in China, India, Mexico, Morocco and Thailand. The malware identifies a banking app on the victim’s phone and displays a fake update prompt. It then removes the original application and downloads a modified replacement tailored to that bank.
Also Read: UAE Central Bank Tightens Rules on Outages, Fraud & Cyberattacks
The altered app contains a mechanism designed to conceal signs of tampering from security checks. It can disguise the app’s signing certificate, hide active Accessibility services and interfere with screen-capture and Play Integrity checks.
“When the app asks Android for its signing certificate, the hook substitutes the genuine certificate and hides the test-key signature. When it queries enabled Accessibility services, the hook returns an empty list, so the controlling service is invisible,” ThreatFabric researchers said. Hirudo can also collect SMS messages, including an initial scan covering 90 days and messages from specified bank and wallet senders.
ThreatFabric said the malware marks a shift towards attacks that manipulate security checks from inside the targeted application. This makes locally generated security signals less reliable when an app may have been replaced.
The firm recommends that banks verify Play Integrity results on their servers and combine them with behavioral analysis. It also advises treating Accessibility and screen-capture signals as supporting evidence rather than relying on them alone.
Banks should retain server-side risk checks for logins, credential recovery, beneficiary creation and payment approvals to help detect fraudulent activity.