Hirudo malware swaps banking apps to evade Android checks

The trojan can replace bank apps with lookalikes, letting attackers bypass protections and capture credentials.

Researchers have described Hirudo, a new Android banking trojan that swaps out legitimate banking apps with modified copies so it can bypass app security checks and steal credentials. The malware uses a hooking engine based on YAHFA and Dobby to fake signing details, hide Accessibility services, disable screenshot protection, and relay Play Integrity requests through an attacker-controlled server. ThreatFabric says it has seen fake versions of eight banking apps, with at least seven impersonating Indonesian banks and additional targets in China, India, Mexico, Morocco, and Thailand. The campaign is being spread through seemingly legitimate apps such as Shopora, 1V1 X, ZoyaTV, and KoiShort, which lure users into granting permissions before installing the patched banking app. Once active, Hirudo can take passwords, payment PINs, device-unlock secrets, SMS messages, screen streams, and camera access, while a backend panel exposed thousands of credential records and related device data.