Hirudo Android Trojan Swaps Banking Apps For Self-Blinding Clones

Security researchers at ThreatFabric have uncovered a new Android banking trojan called Hirudo, which replaces legitimate banking apps with tampered copies that blind built-in protections. The firm's Mobile Threat Intelligence team published its findings on October 14, 2026, describing a remote access trojan that pairs credential theft with device control.

Most Android banking malware places fake login screens over genuine apps, but Hirudo goes further by removing the real app and installing a modified version. The patched app looks and behaves like the original, yet it quietly disables the bank's own security checks from inside the application process.

Hirudo currently focuses on Indonesia, where the operators have built dedicated replacements for eight banking apps across seven different banks in the country. However, the malware's code also lists credential targets in China, India, Mexico, Morocco, and Thailand, suggesting the toolkit can easily expand into other markets. A bundled fake checkout page also carries Malaysian bank and wallet branding, further showing that the threat actors design their tools for portability across regions.

Hirudo reaches victims through a dropper app disguised as a shopping app, adult video service, or short-form drama service, such as Shopora, 1V1 X, ZoyaTV, or KoiShort. These lures actually work, loading real storefronts, video catalogs, or drama episodes inside a WebView, so the experience appears completely legitimate to the user.

Behind the scenes, the dropper collects promotion-tracking data, downloads its campaign configuration, and checks whether the Hirudo payload is already running on the device. If the payload is missing, the dropper displays a fake in-app update prompt and offers the bundled trojan as a separate installation package.

The victim must then grant the second app its own permissions, including Accessibility service and notification access, before Hirudo can start collecting data. One shopping dropper even activates a blackhole VPN during installation, cutting the phone's IPv4 traffic while the malicious payload settles onto the device. ThreatFabric notes that several other Android malware families active on the threat landscape currently rely on this same network-blocking technique.

Hirudo maintains a registry of 42 financial apps and uses Accessibility to detect whether any of the eight targeted Indonesian banking apps are installed. The malware compares the app's signing certificate against a stored reference, then displays another fake update prompt to the victim for the banking app.

Without waiting for a tap, Hirudo opens Android's uninstaller for the genuine app and downloads the bank-specific replacement from a dedicated host in parallel. The trojan then drives the Android installer through Accessibility abuse, completing the entire swap with only minimal involvement from the unsuspecting victim.

The replacement keeps the original package name and version number, but the operators sign it with a publicly available Android test key instead. Android refuses to install such a package as an update over the bank-signed original, which explains why Hirudo must remove the legitimate app first. This requirement gives users a real chance to stop the attack by interrupting either the uninstall step or the installer authorization step.

How the Patched App Blinds Its Own Defenses

ThreatFabric reverse-engineered one patched build and found that the operators leave the bank's own code almost untouched, adding just one injected line. That line sits in the app's Application class and loads a self-contained hooking engine from bundled asset files every time the app launches. The engine relies on two open-source frameworks, YAHFA for hooking Java methods and Dobby for hooking native functions, giving attackers deep control. The hooks activate only when the main trojan writes a shared trigger file to the device, so an idle patched app reveals very little.

Once active, the engine turns the banking app's own security checks against it, feeding back answers that the attackers choose in several key areas:

• Signature checks: when the app requests its signing certificate, the hook substitutes the genuine bank certificate and hides the test-key signature completely.
• Accessibility checks: when the app queries enabled Accessibility services, the hook returns an empty list, so the controlling malicious service stays invisible.
• Screen protection: the engine strips the FLAG_SECURE flag, which normally blocks screenshots, allowing attackers to view and record banking screens remotely.
• Device attestation: the engine re-signs key-attestation certificates with a bundled keybox and relays Play Integrity requests over plain HTTP to an operator-controlled server.

The operator server returns an integrity verdict for the banking app to accept, which means a valid response no longer proves the app is untampered. ThreatFabric did find one weakness, since the keybox is publicly leaked, and Google's revocation list already flags at least two of its certificates. Banks that check attestation revocation on their servers can therefore still catch these forged signals before attackers complete any fraudulent transactions.

When a lure app triggers a payment, the payload displays a fake checkout page in a transparent WebView over the dropper's genuine order screen. The page supports eight languages, captures the victim's payment PIN, and then returns a forged success result so the purchase appears to go through. Hirudo also uses bank- and wallet-specific prompts to request login passwords, and reads the real app's screen to display convincing user IDs or amounts.

The trojan also carries several other capabilities that give its operators extensive visibility into the infected phone and its owner's activity, including:

• Lock-screen theft: a full-screen fake pattern overlay captures the first unlock pattern, and one build reads PINs and passwords from the real lock screen.
• Live screen viewing: operators can view the device screen in real time via WebRTC, allowing them to follow the victim's banking sessions.
• Camera access: the malware can open sessions with both the front and rear cameras, giving attackers a view of the victim and their surroundings.
• SMS collection: Hirudo performs an initial 90-day scan of text messages and tracks messages from a configured list of bank and wallet senders.

The operators distribute Hirudo much like legitimate developers promote their apps, using lures themed around football videos, short dramas, and online shopping. They host the malicious APK files on Amazon CloudFront and track campaigns with OpenInstall attribution tools and Meta Pixel IDs, just like real advertisers. ThreatFabric found that some download routes remained live in October 2026, and one casino-themed route still served the dropper that researchers recovered in August.

Backend data captured by ThreatFabric in August 2026 exposed thousands of stolen credentials and device records, as well as lock-screen history and detailed financial profiles. These profiles included monthly income and risk score fields, and operators labeled some records as phished, pointing to a workflow built around monetizing stolen data. This mature back office shows that Hirudo's operators run an organized fraud business rather than a short-lived experimental campaign targeting a single bank.