Techie Tonic: Hirudo Android malware replaces banking apps to steal credentials

Hirudo, a new Android malware strain, is targeting banking applications by replacing them with counterfeit versions. This malware, named after the Latin word for leech, quietly attaches itself to devices and feeds on sensitive financial information, stealing credentials and intercepting security codes. The threat comes in the form of seemingly harmless advertisements for free services, which lead users to websites mimicking the Google Play Store.

Upon clicking the advertisement, users are directed to install a seemingly regular update. However, this update is actually the malicious malware, which gains elevated permissions like Accessibility Services and Notification Access. These permissions allow the malware to monitor screen activity, read notifications, intercept one-time passwords, and perform actions on behalf of the user.

To further trick users, the malware encourages them to uninstall their legitimate banking applications and installs a counterfeit version with the same icon, name, and appearance. Despite its sophistication, Hirudo relies on human cooperation, as it cannot directly replace legitimate banking apps due to Android security measures.

Financial institutions must validate security decisions on server-side to counter this emerging threat, as smartphones have become central hubs for banking, identity verification, communications, and authentication.