Hirudo Android Banking Trojan Replaces Apps to Bypass Built-In Security Checks
Summary
ThreatFabric says Hirudo replaces eight Indonesian banking apps with tampered copies that bypass in-app security checks, while stealing credentials and enabling remote control. It is delivered through fake update prompts in dropper apps.
Key points
- Hirudo is delivered by shopping, adult-video, and entertainment dropper apps that prompt users to install it as a separate app.
- Fake storefronts, video catalogues, and other lure content make the droppers appear legitimate; distribution pages reportedly impersonate Google Play Store listings.
- The malware targets credentials across Indonesia, China, India, Mexico, Morocco, and Thailand; it can also capture payment PINs, screens, camera input, and SMS.
- For eight Indonesian banking apps, Hirudo prompts users to uninstall the genuine app and installs a bank-specific, tampered replacement.
- The replacements use a hooking engine to manipulate signing-certificate, accessibility, screen-capture, and Play Integrity checks.
- The operation’s backend manages device control, campaigns, and stolen data, including lock-screen history and financial profiles.
- ThreatFabric says the technique can make app-generated integrity signals attacker-influenced; it recommends verifying them server-side.
Article Details
- Attack Vectors
- Dropper apps posing as shopping, adult-video, entertainment, short-drama, and football apps serve Hirudo as a separate package through a fake in-app update.
- Fake web pages resembling Google Play Store landing pages distribute the dropper apps; users are reported to be directed to them through ads on Meta-owned social media platforms.
- Hirudo prompts users to uninstall genuine banking apps and downloads bank-specific patched replacements that return attacker-supplied responses to security checks.
- The malware uses fake payment-PIN, bank-login, lock-screen pattern, and PIN screens to capture credentials, and enables remote device control, screen and camera capture, and SMS theft.
- A deliberately non-functional VPN connection is configured before payload installation to block internet access and reduce the effectiveness of online reputation and code-analysis checks.
- Defensive Notes
- Treat local app signals—including signing certificates, accessibility-service lists, and integrity verdicts—as potentially attacker-influenced when an app may have been replaced; verify them server-side.
- A valid Play Integrity response alone is not evidence that an app is untampered when the request has been relayed rather than genuinely produced.
- The article notes that the VPN-based blocking mechanism does not completely disable Play Protect because it can also detect known potentially harmful applications offline.
MITRE ATT&CK
T1417Hirudo displays fake payment, banking-login, and lock-screen prompts to capture user-entered credentials and PINs.T1437.001Play Integrity requests are relayed over plain HTTP to an operator-controlled server, which returns a verdict to the app.T1476Hirudo is delivered as a separate Android installation package through dropper apps that present it as an in-app update.T1513Hirudo enables screen capture and remote viewing; its patched banking-app engine also strips FLAG_SECURE so screens can be recorded remotely.
People
Malware
HirudoCybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks fromStreamRatAs observed in the case of StreamRat, the malware implements an anti-detection technique based on blocking Internet access by configuring a deliberately non-functional VPN connection prior to the payload installation.
Products
AndroidCybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks fromGoogle Play Protectto the payload installation. This is seen as an attempt to prevent other apps and services, like Google Play Protect, from carrying out cloud-based checks of the payload.Play Integrityreplacements embed a hooking engine to blind signature, accessibility, screen-capture, and Play Integrity checks from within the app. The replacement targets eight Indonesian apps.
Countries
ChinaDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.IndiaDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.IndonesiaDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.MexicoDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.MoroccoDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.ThailandDutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.