Cybersecurity researchers have disclosed details of a new Android banking trojan named Hirudo that uses modified versions of legitimate banking applications to bypass security protections built into the original apps. According to Dutch mobile security company ThreatFabric, the malware represents a shift in how Android banking threats are targeting financial applications by moving beyond traditional credential theft methods and attempting to interfere with the security checks performed inside banking apps themselves.
ThreatFabric reported that Hirudo has been linked to replacement versions of eight Indonesian banking applications, while the malware’s credential targeting activity has been observed across several countries including Indonesia, China, India, Mexico, Morocco and Thailand. The operation combines multiple capabilities, including credential theft, device control, screen and camera capture, SMS interception and backend management features that allow operators to manage campaigns and collected information. Eward Driehuis, vice president of fraud engineering at ThreatFabric, said the operation combines several capabilities with a mature backend infrastructure designed to support its activities. The malware is distributed through dropper applications disguised as legitimate entertainment, shopping and video-related services. These applications provide functional content to appear trustworthy while carrying a separate installation package containing the Hirudo remote access component. ThreatFabric explained that the dropper applications collect campaign-related information, retrieve configurations and check whether the malicious payload has already been installed with required accessibility and notification permissions. If the malware is not detected, users may be shown a fake update prompt that attempts to convince them to install the additional component.
Researchers noted that Hirudo is installed as a separate application and requires specific permissions before it can perform its activities. The malware also uses techniques designed to reduce detection by security services, including configuring a non-functional VPN connection before installing its payload. This behavior is believed to reduce the effectiveness of online reputation and code analysis mechanisms, although ThreatFabric noted that Google Play Protect continues to provide offline detection capabilities for known harmful applications. The main feature that separates Hirudo from many traditional Android banking trojans is its ability to replace targeted banking applications with altered versions designed to bypass internal security checks. ThreatFabric found that these modified applications include mechanisms intended to interfere with signature validation, accessibility checks, screen capture protections and Play Integrity verification. The malware identifies installed banking applications, displays fake update notifications, removes the legitimate application and installs a modified replacement designed for a specific financial service.
According to researchers, the modified versions attempt to provide attacker-controlled responses when security checks are performed. These include returning expected application signing information, hiding accessibility service activity and removing protections that prevent unauthorized screen recording. ThreatFabric also highlighted that key attestation information used by the malware relies on a publicly leaked keybox, while integrity verification requests may be redirected through attacker-controlled infrastructure, meaning a valid response does not always guarantee that an application remains trustworthy. The researchers said Hirudo campaigns have also relied on fake websites designed to resemble Google Play Store pages for shopping, short drama and football applications. Users are believed to have been directed to these pages through advertisements on social media platforms. The backend infrastructure supporting Hirudo allows operators to manage campaigns and collect information such as device details, lock screen history and financial profiles containing additional user-related data.
ThreatFabric warned that the development shows how Android banking malware operators are increasingly focusing on application-level security mechanisms. By modifying targeted applications rather than only controlling devices externally, attackers can attempt to influence the security signals generated by those applications. Researchers advised organizations and users to treat locally generated security information carefully and ensure that important verification processes are strengthened through server-side validation. The findings follow ThreatFabric’s earlier research into StreamRat, another Android threat campaign that used advertisements and fake streaming service applications to gain control over compromised devices. The cybersecurity firm said StreamRat relied on accessibility services and screen control features to provide operators with extensive remote access capabilities. Together, these discoveries highlight the continued evolution of Android malware campaigns targeting financial services and mobile users.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
