Researchers have discovered a new Android malware called Hirudo that targets banking service users by replacing legitimate banking apps with modified versions on the device. According to a report by mobile security company ThreatFabric, the malware uses a code-injection engine to bypass application-signature checks, Accessibility services, and Play Integrity.
Malicious versions of eight banking apps were detected, including apps belonging to at least seven Indonesian banks. The campaign also targeted financial institutions in China, India, Mexico, Morocco, and Thailand, while the number of victims remains unknown.
How Does Hirudo Reach Devices?
The malware usually arrives through apps that appear legitimate and offer shopping or entertainment content, such as Shopora, 1V1 X, ZoyaTV, and KoiShort. These apps act as malware downloaders, then display a fake update notification that leads users to grant them additional permissions, including Accessibility access.
After the permission is enabled, the malicious app begins removing the real banking app, then downloads a modified version and attempts to install it. ThreatFabric describes the process as risky for the attacker, as the user can interrupt it at two stages.
Turning Protection Mechanisms into a Bypass Tool
The modified version retains most of the banking app's original code, but adds an engine built on the open-source YAHFA and Dobby frameworks. The engine operates inside the banking app's own process, allowing it to manipulate the results of checks instead of attacking the app from outside.
- Replacing the original signing certificate when it is queried.
- Hiding enabled Accessibility services.
- Disabling screenshot protection, allowing remote viewing and recording.
- Modifying key-attestation certificates and routing Play Integrity requests through a server controlled by the operators.
What Can the Attackers Steal?
Hirudo can steal banking account passwords, payment PINs, device-unlock secrets, and SMS messages, in addition to streaming the phone's screen and controlling both cameras. It also uses fake payment pages to collect payment PINs, then displays a fake success result to conceal the data theft.
ThreatFabric found thousands of records containing app credentials in an unsecured backend panel, along with device data, lock screens, and financial files. The report does not specify whether this data belongs to all victims or only some of them.
What Are the Limitations, and What Should Be Done?
The bypass methods do not work without limitations. The embedded attestation key may have been publicly exposed, and Google listed two of its certificates among the compromised certificates, allowing servers to detect forgery when performing server-side certificate-revocation checks.
ThreatFabric believes that Hirudo represents an escalation in Android banking-account-stealing malware techniques because it targets protection mechanisms inside the apps themselves. It recommends that banks perform integrity verification and attestation on the server, tie checks to sessions and sensitive operations, and retain behavioral and transaction-risk controls.
Users are advised to update their devices, avoid APK files from unofficial stores, and conduct regular scans using Play Protect.