ThreatFabric researchers discovered new Android malware called Hirudo, which combines the functionality of a traditional banking trojan with the full capabilities of a remote-access tool. The malware currently targets eight Indonesian banking applications, with internal indicators suggesting that it could be adapted to target banks in China, India, Mexico, Morocco, and Thailand.
Hirudo does not merely steal login credentials from the device; it also allows the attacker to view the screen in real time through WebRTC, control the phone through accessibility services, and access both the front and rear cameras. It also collects text messages, including an initial scan covering 90 days and a specific list of senders from banks and wallets.
How Does the Malware Reach the Phone?
Hirudo is distributed through a dropper embedded in applications that appear legitimate, such as an app for shopping, watching adult videos, or short dramas, and is promoted through social media. After the app is installed, the dropper checks whether Hirudo is present on the device, then installs the malicious payload if it is not.
When it detects a specific Indonesian banking application, the malware displays a fake update prompt, then removes the genuine app and downloads a modified version linked to the targeted bank. This makes it appear to the user that they are interacting with the usual banking app, while the fake version operates as an interface for theft and control.
Bypassing In-App Integrity Checks
The modified version includes an engine for intercepting application calls, with the aim of disabling digital-signature checks, accessibility services, screen capture, and Play Integrity from within the application itself. According to the researchers, the engine can replace the signing certificate requested by Android with the original certificate and conceal the test signature. It also returns an empty list when accessibility services are queried, making the attacker’s service invisible to inspection.
The importance of this technique lies in shifting the confrontation from device checks to the integrity mechanisms inside the replaced application itself. Therefore, the signals produced by a replaced application cannot be considered reliable on their own, and the engine’s reusability could make it easier to direct the attack at other applications and regions.
What Should Financial Institutions Review?
- Verify Play Integrity and enforce its results on the server, without considering a valid result alone sufficient evidence, since Hirudo may relay verification requests through its own server.
- Use multilayered behavioral analytics to detect fraudulent patterns, while treating the absence of behavioral data as a signal worthy of investigation.
- Consider accessibility and screen-capture signals supporting evidence rather than standalone blocking conditions, and incorporate them into risk calculations.
- Maintain transaction-risk controls for login, credential recovery, beneficiary creation, and payment approval, because a falsified local result cannot replace a server-side decision.
The practical warning for institutions is that relying on a single in-app check is no longer sufficient when malware can replace the application itself and conceal control components. Details available about Hirudo’s operators and the scale of infections remain unmentioned in the source material, limiting the ability to estimate the campaign’s actual scope.