How Hirudo Android malware evades banking app defenses
A new Android malware strain named Hirudo has been observed replacing legitimate banking applications with trojanized versions designed to bypass critical security mechanisms. According to a report from mobile security firm ThreatFabric published on October 14, 2026, the malware uses a hooking engine to manipulate app behavior at runtime, allowing it to steal credentials and remotely control infected devices.
Hirudo achieves this by substituting genuine banking apps with modified copies that retain nearly all original code but inject malicious functionality. The trojanized apps abuse Accessibility services to silently install themselves after launching the legitimate app’s uninstaller and downloading the patched version from attacker-controlled servers.
Evasion techniques used by Hirudo
Once active, the malware’s hooking engine — built on the open-source frameworks YAHFA and Dobby — performs several evasion actions inside the banking app’s process:
- Substitutes the authentic signing certificate when queried by the system
- Hides enabled Accessibility services to avoid detection
- Removes screenshot protection, enabling remote screen viewing and recording
- Modifies key-attestation certificates and relays Play Integrity requests through operator-controlled servers
"With the engine running inside the banking app's own process, the app's defenses are turned against it,"
These tactics allow Hirudo to bypass app-signature validation, Accessibility monitoring, and Google’s Play Integrity API — three layers designed to prevent tampering and fraud on Android devices.
Limitations and detection risks
ThreatFabric notes that the malware’s evasion methods are not foolproof. The attestation keybox bundled with the malicious apps has been publicly leaked, and Google has flagged two of its certificates as compromised. This means server-side revocation checks can detect the forgeries, potentially limiting the malware’s effectiveness in environments with strict backend validation.
Despite these limitations, once installed, Hirudo enables extensive surveillance and data theft. It can steal banking passwords, payment PINs, device-unlock secrets, and SMS messages; stream the screen to attackers; access both cameras; and capture audio in real time.
Fake checkout pages and credential harvesting
The malware presents victims with counterfeit checkout pages that collect payment PINs before displaying a fabricated payment-success message. This deceives users while silently harvesting their financial data. ThreatFabric researchers discovered thousands of application-credential entries in an unsecured backend panel linked to Hirudo, including device information, lock-screen data, and financial profiles — though the total victim count remains unknown.
Targeted regions and distribution method
Hirudo has primarily targeted banking apps in Indonesia, with confirmed impersonation of at least seven Indonesian financial institutions. However, the malware also targets organizations in China, India, Mexico, Morocco, and Thailand.
Infection typically occurs through trojanized loader apps posing as legitimate software — such as shopping apps (Shopora), adult content platforms (1V1 X), or short-drama services (ZoyaTV, KoiShort). These apps deliver the promised functionality while secretly installing Hirudo. Users are tricked via fake "update" notifications that prompt them to grant dangerous permissions, especially Accessibility services.
Recommendations for users and institutions
ThreatFabric advises banks to strengthen security by validating app integrity and attestation server-side, binding checks to user sessions and protected actions, and retaining behavioral and transaction-risk monitoring.
Android users are urged to:
- Keep devices updated with the latest security patches
- Avoid installing APK files from unofficial app stores
- Regularly run Google Play Protect scans
The researchers conclude that Hirudo represents a deliberate shift in Android banking malware tactics — moving from broad device-level attacks to focused subversion of the security mechanisms embedded within banking applications themselves.
Source: BleepingComputer