Cybersecurity
Hirudo malware replaces banking apps
ThreatFabric said the Android malware used patched banking apps to bypass security checks, steal credentials and device data, and spread through apparently legitimate apps that acted as loaders.
- ThreatFabric said Hirudo used patched copies of banking apps to bypass signature, Accessibility and Play Integrity checks.
- The malware had impersonated at least seven Indonesian banks and had also targeted financial organisations in China, India, Mexico, Morocco and Thailand.
- It reached devices through apparently legitimate shopping, adult-content and short-drama apps that acted as loaders.
- ThreatFabric found thousands of credential entries in an unsecured backend panel, and said the number of victims was unknown.
ThreatFabric said Hirudo kept most of the original banking app code but added a hooking engine built on YAHFA and Dobby. The patched app changed certificate checks, hid Accessibility services, removed screenshot protection and sent Play Integrity requests through an operator-run server.
The malware was delivered through apps that looked legitimate and offered shopping, adult content or short drama, including Shopora, 1V1 X, ZoyaTV and KoiShort. The researchers said these apps displayed a fake update notice and then pushed permission prompts, including for Accessibility services.
Once installed, Hirudo launched the real banking app’s uninstaller, downloaded the modified version and used Accessibility permission to install it. ThreatFabric said the process was vulnerable at two points because a victim could interrupt it.
The report said Hirudo had impersonated at least seven Indonesian banks and had also been aimed at financial organisations in China, India, Mexico, Morocco and Thailand. It could steal banking passwords, payment PINs, device-unlock secrets and SMS messages, and it could stream the screen and access both cameras.
ThreatFabric said the malware’s fake checkout pages took payment PINs and then showed a false success result. It also found thousands of application-credential entries in an unsecured backend panel, along with device, lock-screen and financial-profile data; the researchers said the victim count remained unknown.
Named in this story
Companies
- ThreatFabric
- mobile security company whose researchers wrote the report
- listed two compromised certificates
Products and systems
- Hirudo
- Android malware described in the report
- Shopora
- shopping app used as a malware loader
- 1V1 X
- adult-content app used as a malware loader
- ZoyaTV
- short-drama app used as a malware loader
- KoiShort
- short-drama app used as a malware loader
- YAHFA
- open-source framework used in the hooking engine
- Dobby
- open-source framework used in the hooking engine
- Play Protect
- recommended for periodic scans
Places
- Indonesia
- where at least seven banks were impersonated
- China
- where financial organisations were also targeted
- India
- where financial organisations were also targeted
- Mexico
- where financial organisations were also targeted
- Morocco
- where financial organisations were also targeted
- Thailand
- where financial organisations were also targeted
How the source tells it
The piece was mostly reportive, but it used long capability lists and researcher language about escalation to create urgency.
- urgency a catalogue of theft, surveillance and evasion capabilities
- alarm researcher warnings about escalation and risky installation steps