Cybersecurity
Hirudo trojan replaces banking apps with patched copies
ThreatFabric said the Android banking trojan Hirudo used dropper apps and fake update prompts to install bank-specific replacements that bypassed app checks and let operators steal credentials and control devices.
- ThreatFabric said Hirudo targeted Android banking apps across Indonesia, China, India, Mexico, Morocco and Thailand.
- The trojan arrived through shopping, adult video and entertainment dropper apps that used fake update prompts to install the payload.
- ThreatFabric said it had identified replacements for eight Indonesian banking apps that bypassed signature, accessibility, screen-capture and Play Integrity checks.
- The company said Play Integrity requests were relayed over plain HTTP to an operator-controlled server, and the engine used a publicly leaked keybox.
ThreatFabric said Hirudo was an Android banking trojan that replaced genuine banking apps with modified copies. It said the operation combined credential theft, device takeover, camera and screen capture, SMS theft and remote control.
The malware was delivered through shopping, adult video and entertainment dropper apps, including Shopora, 1V1 X, KoiShort and ZoyaTV. Those apps loaded real content, checked whether the payload was already present, and if it was not, showed a false update prompt to install it as a second app.
ThreatFabric said the replacement apps were built for eight Indonesian banking apps. It said they checked the installed bank app, compared its signing certificate with a stored value, removed the genuine app and installed a bank-specific copy in parallel.
The company said the copy could return attacker-fed answers for security checks by imitating the signing certificate, hiding accessibility services, removing the secure-screen flag and relaying Play Integrity requests to an operator-controlled server. It also said fake websites posing as Google Play Store pages were used to distribute the droppers, with ads on Meta platforms directing users to them.
Named in this story
People
- Eward Driehuis
- ThreatFabric vice president of fraud engineering who described the operation
Companies
- ThreatFabric
- Dutch mobile security company that said it identified the malware
- Meta
- social media company whose ad platforms directed users to fake pages
Products and systems
- Hirudo
- Android banking trojan that used patched app replacements
- Android
- platform targeted by the trojan
- Google Play Protect
- protection service the technique tried to hinder
- Play Integrity
- attestation system whose requests were relayed
- Google Play Store
- storefront whose landing pages were impersonated
- Shopora
- one of the dropper apps
- 1V1 X
- one of the dropper apps
- KoiShort
- one of the dropper apps
- ZoyaTV
- one of the dropper apps
How the source tells it
The article read as a technical security report, with most of its colour coming from ThreatFabric's escalation warnings and defender guidance.
- threat escalation the researchers framed the tampering inside target apps as a deliberate escalation and something that stood out
- defensive warning the closing guidance singled out checks defenders should treat as attacker-influenced