Malware · 5h ago
ThreatFabric found a new Android trojan, Hirudo, replacing legitimate banking apps with patched copies for eight Indonesian bank apps. The same campaign also reaches banks in China, India, Mexico, Morocco, and Thailand.
The patched app keeps most of the real code but runs a hooking engine inside the app’s own process, where it can fake certificate checks, hide Accessibility services, and blunt Play Integrity checks. That means the bank app itself becomes the trust-breaker: once the modified copy is installed, it can steal credentials, capture screens and audio, and give operators live remote control.
For teams that rely on in-app integrity or Accessibility abuse detection, this is a different failure mode than an overlay or a phishing screen. The exposure sits in the replaced app and the permissions it is tricked into granting, so the usual assumption that the genuine app will notice tampering no longer holds.
2 sources covering this story
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo targets eight Indonesian banking apps with patched replacements that can bypass signature, accessibility, and integrity checks.
Part of the PlainSec briefing for 2026-10-14