Science & Tech · Cybersecurity · 6 hrs ago
Hirudo malware replaces banking apps to bypass Android security checks
Hirudo is a new Android banking malware that replaces legitimate banking apps with modified copies.
Researchers found it targeting eight Indonesian banking apps, while its credential theft reaches financial organizations in Indonesia, China, India, Mexico, Morocco and Thailand.
It is delivered through seemingly functional shopping, adult-content and entertainment apps that show fake update prompts and ask users to grant permissions.
The modified banking apps hide their tampering from built-in security checks, including checks of app signatures and Android’s Play Integrity system.
Once installed, Hirudo can steal banking passwords, payment PINs and messages, while letting attackers view screens and control infected phones.
Researchers found thousands of credential entries in an unsecured backend panel, but the number of victims is unknown.
They advise banks to check app integrity on their servers and users to avoid unofficial app downloads, keep devices updated and run Play Protect scans.
Hirudo is an Android banking trojan that replaces legitimate banking apps with patched copies to bypass security checks.
Researchers identified malicious replacements for eight Indonesian banking apps and said the malware targets financial organizations in six countries.
Hirudo can steal banking credentials and messages, capture screens and audio, and give operators remote control of infected phones.
It is delivered through apps for shopping, adult content and entertainment that show fake update prompts.
Researchers said the number of victims is unknown, though an unsecured backend contained thousands of application-credential entries.
- Who
- Hirudo, an Android banking trojan, and the operators using it. Researchers at ThreatFabric disclosed the findings.
- What
- The malware replaces legitimate banking apps with patched copies that bypass security checks and enables credential theft and remote control.
- When
- Researchers disclosed the findings on October 14, 2026.
- Where
- The replacement apps target Indonesian banks; credential targeting spans Indonesia, China, India, Mexico, Morocco and Thailand.
- Why
- To steal banking credentials and other data and to enable remote control of infected devices.
This story does not have two clearly opposing sides.
Dropper apps show fake update prompts and seek permission for Hirudo.
Hirudo launches the genuine banking app’s uninstaller and downloads a patched copy.
The patched app uses a hooking engine to bypass security checks and Hirudo can steal data and remotely control the device.
ThreatFabric’s findings were reported by BleepingComputer and The Hacker News.
- Banking app replacements
- Eight Indonesian banking apps
- Countries targeted
- Indonesia, China, India, Mexico, Morocco and Thailand
- Delivery apps
- Shopora, 1V1 X, ZoyaTV and KoiShort
- Backend findings
- Thousands of application-credential entries in an unsecured panel
- Victim count
- Unknown
2 sources
What people are saying
The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend.
With the engine running inside the banking app's own process, the app's defenses are turned against it.
Hirudo marks a deliberate escalation in how Android bankers approach hardened applications,
The lure is functional, loading real content in a WebView, a storefront, a video catalogue or short dramas, so the experience looks legitimate.