Hirudo Android malware swaps banking apps to dodge checks
A new Android banking trojan called Hirudo removes legitimate banking apps from infected phones and installs tampered copies that switch off the apps' own security checks, according to mobile security company ThreatFabric.
The researchers found malicious versions of eight banking apps. Each one carries a hooking engine that defeats app-signature, Accessibility and Play Integrity checks. It does this by handing back substituted certificate information or by returning empty lists when the app asks what is running on the device. Play Integrity is Google's service that lets apps confirm they are running unmodified on a genuine Android device.
Hirudo has been seen impersonating at least seven Indonesian banks. It also targets financial organisations in China, India, Mexico, Morocco and Thailand.
Delivered through working apps
The malware usually arrives inside apps that look legitimate and actually do what they promise. ThreatFabric named a shopping app (Shopora), an adult content app (1V1 X) and short drama apps (ZoyaTV, KoiShort).
These apps work as loaders. They show the user a fake "update" notice, which leads to prompts asking for permissions, including access to Accessibility services. These Android features are meant to help users with disabilities, but malware often abuses them to read the screen and tap buttons on the user's behalf.
After installation, Hirudo starts the uninstaller for the real banking app, downloads a patched copy and uses its Accessibility permission to install it. ThreatFabric notes that this step is risky for the attackers, because the victim has two chances to interrupt the process.
Turning the bank's defenses around
The patched app keeps nearly all of the original code. The difference is a hooking engine built on the open-source frameworks YAHFA and Dobby. When the app starts, the engine:
- returns the genuine signing certificate whenever the app checks for it
- hides any Accessibility services that are enabled
- removes screenshot protection, so the screen can be viewed and recorded remotely
- alters key-attestation certificates and passes Play Integrity requests through a server controlled by the operators
"With the engine running inside the banking app's own process, the app's defenses are turned against it," the researchers said.
These tricks have limits. The attestation keybox shipped with the malware has already leaked publicly, and Google lists two of its certificates as compromised. Revocation checks done on the server side can therefore catch the forged attestations.
What it steals
Once running, Hirudo can capture banking passwords, payment PINs, device-unlock secrets and SMS messages. Operators can stream the screen live, take control of the phone in real time, take screenshots, record audio and use both cameras.
The malware also shows fake checkout pages that ask for the payment PIN. After the victim enters it, a made-up "payment successful" screen appears while the data is stolen in the background.
ThreatFabric found an unsecured backend panel that held thousands of application-credential entries, along with device, lock-screen and financial-profile data. The number of victims is still unknown.
The researchers describe Hirudo as "a deliberate escalation in how Android bankers approach hardened applications." The attackers are moving away from fooling device-level integrity checks and are now going after the protections built into the banking apps themselves.
ThreatFabric advises banks to validate integrity and attestation on the server side, tie these checks to sessions and protected actions, and keep behavioural and transaction-risk controls in place. Users should install updates, avoid APK files from unofficial stores and run Play Protect scans from time to time.
Our Take
Hirudo shows the limits of client-side protection. If an attacker controls the app process, every check that runs inside it can be made to lie. This suggests that banks relying mainly on in-app detection should move more of their trust decisions to the server, which is what ThreatFabric recommends.
The infection route also fits a wider pattern in mobile threats. Malware arrives through sideloaded apps or comes preinstalled on cheap Android phones, and both routes skip Google Play's screening. Basic hygiene, such as applying the latest Android security updates, still matters, but it will not stop a user who grants Accessibility access to a fake update.
It is worth watching whether the operators replace the leaked keybox and whether Hirudo spreads beyond its current focus on Indonesia.