Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
AI-summarised brief · reviewed before publication
Researchers have uncovered a new Android banking trojan, Hirudo, that replaces legitimate banking apps with patched copies engineered to bypass internal security checks. ThreatFabric identified eight compromised Indonesian banking apps and noted the malware’s reach extends to users in Indonesia, China, India, Mexico, Morocco and Thailand. Delivered via seemingly benign shopping, adult video and entertainment apps, Hirudo appears as an in‑app update, installs as a separate package, and then gains accessibility and notification permissions. It employs a fake VPN to hinder online reputation checks, while still vulnerable to offline detection by Google Play Protect. The trojan can steal credentials, capture screens and camera feeds, intercept SMS, and grant remote control, using a leaked attestation keybox to spoof Play Integrity and other anti‑tampering mechanisms.
💡 Why It Matters
- · By hijacking the banking app itself, Hirudo sidesteps the very defenses users trust, turning a legitimate financial interface into a covert data‑exfiltration channel.
