Hirudo Android Malware Replaces Banking Apps to Evade Security Checks
Summary
Hirudo is delivered through deceptive apps and replaces banking apps with patched copies that bypass security checks. It can steal credentials and messages, remotely control devices, and capture screens and audio.
Key points
- ThreatFabric reports Hirudo impersonating banking apps, including those of at least seven Indonesian banks, and targeting financial organizations in several other countries.
- Deceptive shopping, adult-content, and short-drama apps act as loaders, prompting users to grant permissions before installing Hirudo.
- Hirudo uninstalls the legitimate banking app and installs a patched copy that uses YAHFA and Dobby hooking frameworks.
- The patched app can spoof signing certificates, hide Accessibility services, remove screenshot protection, and alter key-attestation checks.
- Hirudo can steal banking credentials, payment PINs, device-unlock secrets, and SMS messages, while enabling screen streaming and camera access.
- Researchers found thousands of credential entries and other sensitive data in an unsecured backend panel; the number of victims is unknown.
- ThreatFabric recommends server-side integrity checks and transaction-risk controls for banks; users should avoid unofficial APK sources and keep devices updated.
Article Details
- Attack Vectors
- Hirudo is delivered through apps presented as shopping, adult-content, or short-drama apps. The apps display fake update notifications that prompt users to grant permissions, including Accessibility access.
- After installation, Hirudo launches the legitimate banking app's uninstaller, downloads a patched copy, and uses Accessibility permission to install it.
- The patched banking app uses a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks, including by substituting certificate information and returning empty lists.
- Hirudo steals banking credentials, payment PINs, device-unlock secrets, and SMS messages; it can also stream screens to operators, access cameras, capture audio, and collect device and financial-profile data.
- Fake checkout pages collect payment PINs and show fabricated payment-success results.
- Defensive Notes
- Banks should validate integrity and attestation server-side, bind checks to sessions and protected actions, and retain behavioral and transaction-risk controls.
- Android users should keep devices up to date, avoid APK files from unofficial Android stores, and periodically run Play Protect scans.
- The article says the bundled attestation keybox was publicly leaked and Google lists two of its certificates as compromised, allowing server-side revocation checks to detect those forgeries.
Malware
Products
AndroidHirudo Android malware replaces banking apps to evade security checksPlay IntegrityResearchers identified malicious copies of eight banking apps that use a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists.Play ProtectAndroid users are strongly recommended to keep their devices up-to-date, avoid installing APK files sourced from unofficial Android stores, and periodically run Play Protect scans.
Tools
DobbyThreatFabric found that the malicious copy of a banking app retains almost all of the original app’s code, but loads a hooking engine built on the open-source frameworks YAHFA and Dobby.YAHFAThreatFabric found that the malicious copy of a banking app retains almost all of the original app’s code, but loads a hooking engine built on the open-source frameworks YAHFA and Dobby.
Countries
Chinaimpersonating at least seven Indonesian banks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.Indiaat least seven Indonesian banks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.Mexicoat least seven Indonesian banks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.Moroccoseven Indonesian banks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.Thailandbanks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.