Security researchers at ThreatFabric discovered a new Android banking trojan called Hirudo that replaces real banking apps with trojanized copies. The malware currently targets eight Indonesian banking apps but could expand to other countries soon.
Hirudo spreads through dropper apps advertised on social media. These apps pose as shopping, adult video, or short drama apps. Once a victim installs the dropper, it checks for Hirudo on the device and installs the trojan if it finds nothing.
The malware then detects which supported banking app sits on the victim’s phone. It shows a fake update prompt, uninstalls the real app, and downloads a modified replacement. According to ThreatFabric, the fake app includes a hooking engine that defeats multiple security checks. For instance, when the app requests its signing certificate, the hook returns the genuine certificate instead. It also hides active Accessibility services and blocks screen capture and Play Integrity checks.
However, Hirudo does more than just steal credentials. It also gives attackers live screen access through WebRTC and enables remote camera sessions on both front and rear cameras. Additionally, it collects SMS messages from the device, including a 90-day scan of past messages. The malware specifically targets texts from banks and wallet providers.
ThreatFabric warned that “Hirudo marks a deliberate escalation in how Android bankers approach hardened applications.” Moreover, the researchers noted that its reusable hooking engine can easily shift to target other apps and regions. Internal code already references banks in China, India, Mexico, Morocco, and Thailand.
As a result, ThreatFabric recommends that banks verify Play Integrity checks on the server side. The firm also urges financial institutions to apply behavioral analytics and treat missing behavioral data as suspicious. Furthermore, banks should use Accessibility and screen-capture signals for risk scoring rather than simple blocking.
Android users should only download apps from the Google Play Store and avoid installing apps promoted through social media ads.
