Hirudo: Android malware that swaps in a patched copy of your banking app to dodge its own security checks

Android banking malware has long been a cat-and-mouse game between fraud gangs and the hardening checks banks bolt onto their apps: app-signature verification, screenshot blocking, Play Integrity attestation, and key attestation that binds secrets to genuine hardware. A new trojan tracked by ThreatFabric under the name Hirudo changes the premise of the game entirely. Instead of fighting those checks from the outside, it installs its own patched copy of the banking app and makes the checks lie. In ThreatFabric's Oct 14 report, eight banking apps across seven Indonesian banks were found to have purpose-built malicious replacements that embed a hooking engine to blind signature, Accessibility, screen-capture, and Play Integrity checks from within the app's own process.

A trojan disguised as a fake update

Hirudo is delivered the way a large share of Android bankers are: through baitware that actually works. ThreatFabric found distribution through apps for shopping (Shopora), adult content (1V1 X), and short-drama streaming (ZoyaTV and KoiShort). The lures are functional, loading real content in a web view, a storefront, a video catalogue, or short dramas, so the experience looks legitimate. Behind the content the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches campaign configuration, and checks whether the Hirudo payload is already installed with its accessibility service and notification access enabled. If not, it shows a fake in-app update prompt that leads the victim through permission-granting screens, including the Accessibility service, the one permission Android bankers depend on most.

Once active, the attack chain takes a risky two-step detour. Hirudo launches the real banking app's uninstaller, waits for the victim to remove the genuine app, then downloads a patched copy and uses its Accessibility permission to install it. ThreatFabric notes this is a deliberately fragile process: at two points, removing the bank and installing the clone, a suspicious victim can interrupt the swap. The researchers also observed an anti-detection trick seen in the related StreamRat family, a deliberately non-functional VPN connection configured before payload installation to block other apps, including Google Play Protect, from performing cloud-based checks.

Hooking the app's own defenses

The cleverest part of Hirudo is what the replacement clone contains. Reverse engineering one patched build, ThreatFabric found the bank's own code left almost untouched. A single injected line in the app's Application class loads a self-contained hooking engine from bundled asset files at launch, built on two open-source frameworks: YAHFA, which replaces Java methods, and Dobby, which hooks native functions. The engine arms its hooks only when the trojan has left a trigger file on the phone, so an idle clone reveals almost nothing.

• Substitutes the genuine signing certificate when the app queries it, defeating signature checks
• Hides the trojan's own enabled Accessibility services from the app's inspection
• Removes screenshot protection, allowing operators to stream and record the screen
• Modifies key-attestation certificates and relays Play Integrity requests through an operator-controlled server

In ThreatFabric's words, with the engine running inside the banking app's own process, the app's defenses are turned against it. But the researchers are careful to flag the limits. The bundled attestation keybox has been publicly leaked, and Google has listed two of its certificates as compromised, so server-side revocation checks can already detect some of the forgeries. The technique is reusable, ThreatFabric stresses: this is a generic engine that can be pointed at other applications, other regions, and other checks, not a one-off patch for Indonesian banks. The trojan's target registry references roughly 40 financial apps.

What operators steal, and what it costs

With the patched clone in place, Hirudo operates as a full remote-access trojan. It steals banking passwords, payment PINs, device unlock secrets, and SMS messages, streams the screen to operators in real time, accesses both cameras, and can remotely control the infected phone. Money transfer is where the deception peaks: fake checkout pages inside the clone collect payment PINs, then display a fabricated payment-success result to convince the victim the transfer worked. One observed anti-analysis behavior also stands out: an unsecured backend panel exposed thousands of harvested application-credential entries alongside device, lock-screen, and financial-profile data, giving the researchers a window into an operation whose total victim count still remains unknown.

Regionally, Hirudo is currently aimed at Indonesia, impersonating at least seven local banks, but its target list also covers financial organizations in China, India, Mexico, Morocco, and Thailand. That broad registry, combined with a delivery model built from ordinary app categories, signals a platform the operators intend to keep repointing as banks in new markets harden their apps.

The bigger picture

Hirudo marks a deliberate escalation in how Android bankers approach hardened applications, shifting the battlefield from device-level integrity to the security mechanisms built inside the banking apps themselves. Hooking frameworks like YAHFA and Dobby are commodity tools, which means any well-funded fraud operation can replicate the technique against the next bank's next check. As attestation grows stronger, the answer is moving, and it is moving with the attacker's engine.

Sources: ThreatFabric: Hirudo, from fake updates to patched banking apps; The Hacker News: Hirudo Android Trojan patched banking apps; BleepingComputer: Hirudo Android malware replaces banking apps.

Corrections: Report an error at corrections@wireshaman.com.