ThreatFabric found a new Android trojan, Hirudo, replacing legitimate banking apps with patched copies for eight Indonesian bank apps. The same campaign also reaches banks in China, India, Mexico, Morocco, and Thailand.
The patched app keeps most of the real code but runs a hooking engine inside the app’s own process, where it can fake certificate checks, hide Accessibility services, and blunt Play Integrity checks. That means the bank app itself becomes the trust-breaker: once the modified copy is installed, it can steal credentials, capture screens and audio, and give operators live remote control.
For teams that rely on in-app integrity or Accessibility abuse detection, this is a different failure mode than an overlay or a phishing screen. The exposure sits in the replaced app and the permissions it is tricked into granting, so the usual assumption that the genuine app will notice tampering no longer holds.
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.