Hirudo Android Trojan Replaces Banking Apps to Bypass Security Checks

Cybersecurity researchers have identified Hirudo, an Android trojan that replaces banking apps to bypass security checks.

How Does the Hirudo Malware Work?

Dutch mobile security company ThreatFabric has identified a new Android banking trojan called Hirudo that uses modified versions of legitimate banking applications to bypass security protections and steal sensitive information.

Researchers identified malicious replacements for eight Indonesian banking applications. The malware’s credential-targeting activities extend across Indonesia, China, India, Mexico, Morocco and Thailand.

Hirudo combines credential theft, remote device control, screen and camera recording, and SMS interception. It can also capture banking credentials and personal information through fraudulent login screens.

Unlike conventional banking malware, Hirudo attempts to replace genuine banking applications with modified copies containing mechanisms designed to manipulate security checks.

How Does Hirudo Reach Android Users?

The malware is distributed through deceptive shopping, entertainment and video applications that initially appear to provide legitimate services. Identified applications include Shopora, 1V1 X, KoiShort and ZoyaTV. These applications display functional content while secretly preparing to install the malware through a fake in-app update.

Researchers also identified fraudulent websites resembling Google Play Store pages. Users are believed to encounter these websites through advertisements on Meta-owned social media platforms.

Once installed, Hirudo requests accessibility and notification permissions. It can then display fake banking login screens, capture payment PINs and obtain remote control of infected devices.

The malware also attempts to interfere with cloud-based security checks by restricting internet connectivity through a deliberately non-functional VPN connection. However, this technique does not completely disable Google Play Protect.

How Does It Bypass Banking App Security?

Hirudo’s distinctive capability involves replacing legitimate banking applications with modified versions containing a built-in security bypass mechanism. The malware identifies installed banking applications, checks their signing certificates and presents fraudulent update notifications. It then initiates the removal of the genuine application while downloading a malicious replacement.

The modified application can manipulate signature verification, accessibility checks, screen-capture restrictions and Google Play Integrity responses.

Researchers found that the malware uses a publicly leaked attestation keybox and relays integrity requests to an attacker-controlled server. This allows manipulated applications to return apparently acceptable security results despite being altered.

Why Is Hirudo a Concern for Banking Security?

ThreatFabric warned that Hirudo represents a significant development in Android banking malware because it targets security mechanisms inside banking applications.

Its infrastructure supports multiple campaigns and stores stolen information, including device records, lock-screen histories and financial profiles. Researchers said the approach could be adapted to additional banking applications and geographical regions.

The findings highlight the limitations of relying solely on security signals generated by potentially compromised applications. ThreatFabric recommended verifying application integrity through server-side controls rather than trusting locally generated results.

Hirudo demonstrates how attackers can exploit deceptive app updates to replace legitimate banking applications and manipulate their security checks. Android users should avoid installing applications through unfamiliar websites or advertisements, particularly when prompted to grant sensitive permissions. For financial institutions, the findings underline the importance of independent, server-side verification of banking application integrity.