Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

A new Android banking trojan called Hirudo is designed to bypass security checks by replacing legitimate banking apps with patched versions, according to Dutch cybersecurity researchers at ThreatFabric. This marks a significant escalation in financial fraud targeting Indonesia, China, India, Mexico, Morocco, and Thailand. The malware not only steals credentials and takes control of devices but also captures screens and records SMS messages.

Hirudo is delivered through dropper apps used in shopping, adult video, and entertainment categories, disguised as legitimate content. The trojan is installed as a secondary app with its own permissions, which it then uses to carry out malicious activities. Anti-detection measures include blocking internet access and preventing online reputation and code-analysis mechanisms from detecting the payload.

The trojan targets eight Indonesian banking apps, replacing them with tampered versions that embed a hooking engine to disable signature, accessibility, screen-capture, and Play Integrity checks. It detects the installed banking app using accessibility, checks its signing certificate, and then shows a fake update prompt. The malware also strips the FLAG_SECURE flag to allow remote screen viewing and recording, while using a publicly leaked keybox for key attestation certificates and relaying Play Integrity requests to an operator-controlled server for a verdict.