Hirudo Android Malware Replaces Banking Apps to Steal Credentials and Bypass Security Checks

A new Android banking malware called Hirudo can replace legitimate banking apps with modified versions designed to disable security checks and steal sensitive information.

Researchers at mobile security firm ThreatFabric identified eight malicious copies of banking apps using hook engines to bypass app-signing, accessibility, and Google Play Integrity checks. The malware does this by replacing certificate information or returning an empty list when security services query the device.

Once active, Hirudo can steal bank credentials and payment PINs, remotely control infected phones, collect SMS messages, capture screenshots, record audio, stream the screen, and access both cameras.

Hirudo targets banks in multiple countries

ThreatFabric says Hirudo has been observed impersonating at least seven Indonesian banks. The malware has also targeted financial institutions in China, India, Mexico, Morocco, and Thailand.

The malware is typically delivered through seemingly legitimate apps for shopping, adult content, or short dramas. Examples include Shopora, 1V1 X, ZoyaTV, and KoiShort. These apps provide the functionality they advertise while acting as loaders for Hirudo.

According to researchers, the apps display fake update notifications and pressure users to grant sensitive permissions, including access to Android accessibility services.

How Hirudo replaces banking apps

After installation, Hirudo launches the legitimate banking app’s uninstaller, downloads a patched copy, and installs the modified app by abusing accessibility permissions.

ThreatFabric describes this as a sensitive and dangerous process for the malware because victims can interrupt it at two separate points.

ThreatFabric found that one malicious banking-app copy retained nearly all of the original app’s code. However, it also loaded a hook engine built with the open-source YAHFA and Dobby frameworks.

When the patched app launches, the hook engine performs several evasive actions:

• Replaces the authentic signing certificate when the app is queried.
• Hides enabled accessibility services.
• Removes screenshot protections so operators can view and record the screen remotely.
• Changes the key-attestation certificate and relays Play Integrity requests through an operator-controlled server.

“The engine is running within the process of the banking app itself, so the app’s defenses are against it,” ThreatFabric researchers said.

Leaked certificates may expose Hirudo forgeries

ThreatFabric says Hirudo’s workarounds have limitations. The bundled certificate keybox has been publicly leaked, and Google has listed two of its certificates as compromised. As a result, server-side revocation checks can detect the forged certificates.

When activated on a device, Hirudo can steal bank passwords, payment PINs, device unlock secrets, SMS messages, and other data. It can also stream the screen to operators and provide access to the phone’s cameras.

The malware’s fake checkout page collects payment PINs and displays fraudulent payment-success messages to deceive victims while stealing their information.

Thousands of banking credentials found in exposed panels

ThreatFabric discovered that Hirudo is currently targeting banking apps in Indonesia. Researchers also found thousands of application credential entries in insecure backend panels, along with device, lock-screen, and financial-profile data. The total number of victims remains unknown.

“Hirudo represents a deliberate escalation in how Android bankers approach hardened applications,” the researchers said. The malware shifts its focus from device-level integrity checks to security mechanisms built directly into banking apps.

How banks and Android users can stay safer

ThreatFabric recommends that banks verify integrity and authentication on the server side, bind security checks to sessions and protected actions, and maintain behavioral and transactional risk controls.

Android users should keep their devices updated, avoid installing APK files from unofficial Android stores, and run Google Play Protect scans regularly.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat