Hirudo Android Malware Replaces Banking Apps to Evade Security Checks

A new Android malware called Hirudo steals banking credentials by replacing legitimate banking apps with modified copies, according to mobile security company ThreatFabric. Researchers found malicious copies of eight banking apps.

The patched apps retain almost all of the original code but load a hooking engine based on the open-source frameworks YAHFA and Dobby. It can bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists. ThreatFabric says the process can be interrupted by victims at two points.

ThreatFabric has observed Hirudo impersonating at least seven Indonesian banks. The malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand. It is typically delivered through apparently legitimate shopping, adult-content, or short-drama apps that act as loaders and display fake update prompts.

Once installed, Hirudo can steal passwords, payment PINs, device-unlock secrets, and SMS messages; stream the screen; and access both cameras. Fake checkout pages collect payment PINs and then show fabricated payment-success results. ThreatFabric found two certificates associated with the malware’s bundled attestation keybox that Google lists as compromised, meaning server-side revocation checks can detect those forgeries. Researchers also found thousands of application-credential entries and other data in an unsecured backend panel. The number of victims is unknown.

ThreatFabric recommends that banks check integrity server-side and retain behavioral and transaction-risk controls. The researchers describe Hirudo as a shift toward targeting security mechanisms inside banking apps.