Hirudo malware swaps real Android banking apps for spyware clones

Mobile security firm ThreatFabric disclosed a new Android malware family called Hirudo on October 14 that steals banking credentials by secretly uninstalling a victim's real banking app and replacing it with a tampered copy that has its security checks switched off. The firm found malicious clones of at least seven Indonesian banking apps, along with modified apps tied to financial institutions in China, India, Mexico, Morocco, and Thailand.

Banking trojans that overlay fake login screens on top of real apps are common. Hirudo is more aggressive: rather than tricking a victim into typing credentials into a lookalike screen, it removes the genuine app from the phone entirely and installs its own patched version in its place, so the victim is interacting with malware-controlled software from the first tap.

Hirudo spreads through unrelated apps distributed outside Google Play, including a shopping app called Shopora, an adult-content app called 1V1 X, and short-drama apps named ZoyaTV and KoiShort. These apps work as advertised, then show a fake “update” prompt that walks the victim through granting Accessibility permissions. With that access, Hirudo silently triggers the uninstall flow for the target bank's real app, downloads a patched version from attacker infrastructure, and uses its own Accessibility privileges to complete the install without further prompts.

The patched banking apps use a hooking engine built on the open-source YAHFA and Dobby frameworks to forge the original app's signing certificate when the operating system checks it, hide the fact that Accessibility services are enabled, strip out screenshot protection, and alter key-attestation data so requests to Google's Play Integrity API get silently proxied through an operator-controlled server instead of being answered honestly. ThreatFabric says the operators can harvest banking passwords, payment PINs, device-unlock codes, and SMS messages, as well as stream the phone's screen, access both cameras, and pull screenshots and audio. Fake in-app checkout pages capture payment PIN entries before showing a forged “payment successful” message to avoid raising suspicion.

ThreatFabric also found an unsecured backend panel used by the Hirudo operators containing thousands of stolen credential entries along with device, lock-screen, and financial-profile data — though the firm says the total number of victims is still unknown. There is one built-in weakness in the campaign: the attestation keybox bundled with the malware has leaked publicly, and Google has already flagged two of the certificates it uses as compromised, which lets properly configured server-side integrity checks detect the forged attestations.

ThreatFabric is recommending that banks move signature and integrity validation server-side and bind it to individual sessions rather than trusting on-device checks alone, and that Android users avoid installing APKs from outside official app stores and keep Play Protect scanning turned on. The research was published by ThreatFabric and reported by Bill Toulas for BleepingComputer.