Fake Android Banking Apps Bypass Security, Steal Credentials

Key Takeaways

• A new Android banking Trojan, “Hirudo,” has been discovered using a sophisticated method to bypass security measures.
• Hirudo uninstalls legitimate banking applications and replaces them with malicious, modified versions that appear identical.
• The malware leverages app replacement, credential theft, and remote access capabilities, making it a highly dangerous Remote Access Trojan (RAT).
• It targets users in multiple countries, with a particular focus on Indonesian banking apps, and has already collected thousands of user credentials.
• Users should be extremely cautious about installing apps from unofficial sources and granting Accessibility permissions. Banks must implement robust server-side security checks.

New Android Malware Replaces Legitimate Banking Apps

A novel Android banking Trojan, dubbed Hirudo, has emerged, employing an advanced strategy to commit financial fraud. Unlike typical overlay attacks, Hirudo actively seeks to uninstall a victim’s authentic banking application and replace it with a tampered clone. This malicious substitute retains the original app’s name and version, but integrates additional code specifically designed to circumvent security protocols. Instead of merely displaying fake login screens over legitimate applications, Hirudo’s operators aim to manipulate the banking app itself to conceal the malware’s presence.

This campaign represents a multi-faceted attack, combining app replacement with extensive credential theft and remote control functionalities. Hirudo’s operators can harvest banking passwords, payment PINs, SMS messages, and device-unlock details. Furthermore, the malware enables screen viewing and camera access, transforming it into a full-fledged Remote Access Trojan (RAT) capable of gathering sensitive information and executing actions on compromised devices.

Analysts from ThreatFabric identified this sophisticated malware, reporting that it has prepared replacement applications for eight Indonesian banking apps across seven different banks. The research also revealed a broader list of financial applications targeted by Hirudo, indicating the attackers have developed a flexible system adaptable to a wider range of financial institutions.

Initial Infection Vector and Payload Delivery

Hirudo typically infiltrates devices via seemingly innocuous shopping and entertainment applications. ThreatFabric detailed various lures, including those themed around shopping (e.g., Shopora), adult videos (e.g., 1V1 X), and short dramas (e.g., ZoyaTV, KoiShort). These initial lure applications often present legitimate-looking content, such as a functional storefront or video catalog, while covertly checking for the presence of the separate Hirudo payload.

If the Hirudo payload is not already installed, the lure app prompts the user with a fake update notification, urging them to install a secondary application package. This second application carries the core Trojan and requires additional permissions to activate its credential theft and remote-control capabilities. This two-stage infection process makes the initial download appear less suspicious, while the deceptive update persuades the user to install the more dangerous component. This technique mirrors patterns observed in other Android banking threats, such as TrickMo, which also abused Accessibility permissions.

How the Banking App is Replaced

Once activated, Hirudo exploits Android’s Accessibility service to identify a targeted banking application and verify its signing certificate. Subsequently, it displays a fabricated update message, opens the system’s uninstaller for the genuine app, and then downloads a bank-specific malicious replacement. This replacement application mimics the original’s package name and version but is signed with a public test key rather than the bank’s authentic key. As Android prevents an ordinary update with a mismatched signature, Hirudo first attempts to force the removal of the legitimate application.

This crucial step presents a potential point of failure for the attackers, as the user can interrupt the uninstall process or decline the installation of the malicious replacement. However, if the modified app is successfully installed, it loads a hidden hooking engine built upon the open-source YAHFA and Dobby frameworks. A “hook” fundamentally alters how an application responds to function calls or information requests. Hirudo leverages this mechanism to interfere with internal security checks within the banking app’s own process.

The hooking engine can, for instance, return the bank’s genuine signing certificate instead of revealing the test-key signature of the malicious app. It can also report an empty list of enabled Accessibility services, effectively hiding the malware’s control service, and disable the `FLAG_SECURE` setting, which normally prevents screenshots. This allows operators to remotely view or record banking screens. Furthermore, Hirudo relays certain Play Integrity requests to a command-and-control server, which can then provide a falsified response for the modified app to accept.

This advanced technique means that a seemingly successful integrity check on the device does not reliably confirm an app’s authenticity. ThreatFabric noted that the attackers’ bundled attestation keybox was publicly leaked, and at least two certificates within it are on Google’s revocation list. Banks, therefore, must conduct integrity checks on their own servers, incorporating certificate revocation verification, and should not solely rely on results generated by a potentially compromised mobile device. The sophisticated nature of Hirudo, alongside similar credential-stealing Android campaigns like RatHat, underscores the critical importance of secure initial installation paths as much as subsequent detection methods.

Beyond replacing banking applications, Hirudo is capable of displaying fake payment pages and requesting sensitive information such as login passwords or payment PINs. It can also intercept SMS messages, including those from designated banks and digital wallets. Certain versions of the malware are designed to capture screen-lock patterns or other device unlock details. Its remote-control capabilities are extensive, featuring live screen viewing via WebRTC and the ability to activate the phone’s front or rear camera.

ThreatFabric’s investigation revealed that while the eight specific banking app replacements primarily target Indonesia, the malware’s codebase contains credential targets spanning China, India, Mexico, Morocco, and Thailand. Additionally, the fake checkout feature within Hirudo incorporates branding for Malaysian banks and digital wallets. Backend records from August 2026 reportedly contained thousands of credential entries, device information, and financial profiles, providing clear evidence of a well-organized operation aimed at facilitating widespread financial fraud.

What You Should Do

• For Users:
  • Avoid Unofficial App Stores: Only download banking and other sensitive applications from official app stores like Google Play.
  • Scrutinize Update Requests: Be highly suspicious of any app requesting an update from outside the official app store, especially if it also demands Accessibility service permissions without a clear and justifiable reason.
  • Never Uninstall on Request: Do not uninstall your legitimate banking app or install a replacement at the prompting of an unfamiliar application.
  • Monitor App Behavior: If a banking app unexpectedly disappears or an unknown app requests extensive control over your phone, immediately contact your bank using its official contact channels and have your device professionally checked.
  • Review Permissions: Regularly review the permissions granted to your applications, especially Accessibility services. Disable any suspicious or unnecessary permissions.
• For Banks and Financial Institutions:
  • Implement Server-Side Integrity Checks: Rely on robust server-side Google Play Integrity checks, including comprehensive certificate revocation checks, rather than solely trusting client-side attestations.
  • Enhance Behavior Monitoring: Implement advanced behavioral monitoring and transaction-risk controls to detect anomalous activity, even if an app appears legitimate on the device.
  • Treat Accessibility Signals with Caution: Understand that malware like Hirudo can tamper with Accessibility and screenshot signals; treat these as supporting evidence, not definitive proof of an app’s safety.
  • Monitor Sensitive Actions: Broaden monitoring to encompass critical user actions such as logins, password recovery, adding new payment beneficiaries, and approving transfers.
  • Educate Users: Proactively educate customers about the risks of sideloading apps and the dangers of granting excessive permissions to unfamiliar applications.

Indicators of compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.