Hirudo: the Android trojan that replaces banking apps
The Hirudo Android trojan uninstalls banking apps and replaces them with copies that blind their security checks. Technical details and countermeasures.
On 14 October 2026 ThreatFabric published its analysis of Hirudo, an Android malware that combines a banking trojan with a full-featured RAT. What is new is how it deals with banking apps: instead of laying a fake login screen over the real app, it uninstalls the original app and replaces it with a modified copy that switches off the app’s own security checks from the inside.
The story was covered by BleepingComputer, The Hacker News, SecurityWeek and Security Affairs. The technical details that follow come from ThreatFabric’s report, as reported by those outlets.
Who it targets
According to ThreatFabric, Hirudo carries a list of 42 financial apps, but a ready-made modified copy exists only for 8 apps from 7 Indonesian banks. The sources also mention China, India, Mexico, Morocco and Thailand, with different nuances: BleepingComputer and Security Affairs say the malware already targets users and banks in those countries, while SecurityWeek says the internal code suggests it could also be used against them. No source mentions targets in Europe.
The number of victims is unknown. The panel the operator uses to build droppers and modified apps was reachable without authentication, with cloud buckets and credentials exposed: the August 2026 data includes thousands of credentials, device data, lock-screen history and financial profiles with monthly income and risk score fields. According to Security Affairs, operators flagged records they had already exploited as “phished”, a sign of an organised process for turning stolen data into fraud.
The attack chain
Delivery. Hirudo arrives inside droppers that look like legitimate apps and actually work: shopping (Shopora), adult content (1V1 X), short dramas (ZoyaTV, KoiShort), promoted on social media according to SecurityWeek. The apps load real content in a WebView. According to Security Affairs, downloads are served from Amazon CloudFront, with campaign attribution through OpenInstall and Meta Pixel IDs; some download paths were still live between late September and October 2026.
Installation. If there is a banking app on the phone and Hirudo is not yet installed, the dropper shows a fake update. One dropper that was analysed creates a deliberately broken VPN during installation, cutting off internet access: ThreatFabric believes it is meant to weaken online reputation checks and analysis of the APK, without fully bypassing Google Play Protect (a detail reported only by Security Affairs). Hirudo is a separate app from the dropper and must obtain its own Accessibility and notification permissions.
App replacement. Hirudo detects the banking app through Accessibility services, compares its signing certificate with a stored reference, shows a fake “update” prompt, opens the Android uninstaller without waiting for the user to tap and meanwhile downloads the copy prepared for that bank, which it then installs by abusing Accessibility. The copy has the same package name and version number, but it is signed with a public test key: Android would not install it as an update over the original app, which therefore has to be removed first. ThreatFabric calls this the most delicate step: the victim can interrupt it at two points.
The hooking engine inside the banking app
The bank’s code is left almost untouched: a single line is added to the Application class, which loads a hooking engine at startup built on two open-source frameworks, YAHFA (Java methods) and Dobby (native functions). The engine only activates if it finds a trigger file created by Hirudo on the device; without that file the modified app looks harmless.
Once active, the engine:
- returns the genuine signing certificate when the app asks for it, hiding the test signature;
- answers with an empty list when the app checks which Accessibility services are enabled, so the service controlling it stays invisible;
- removes the screen-capture protection, so the app can be viewed and recorded remotely;
- modifies key attestation certificates and relays Play Integrity requests over plain HTTP to an operator-controlled server, which returns an acceptable result.
There is a limit: the keybox used for attestation has leaked publicly and Google has placed at least two of its certificates on its revocation list, so a server-side revocation check can spot the forgeries.
What it does on the phone
Hirudo steals banking passwords, payment PINs, device-unlock secrets and SMS messages (according to SecurityWeek, with an initial scan of the last 90 days and a configured list of bank and wallet senders). It streams the screen live over WebRTC, accesses both cameras, records audio (according to BleepingComputer) and controls the phone remotely through Accessibility. Fake checkout pages collect the PIN and then display a payment success that never happened.
MITRE ATT&CK for Mobile (our mapping from the reported facts): T1453 (Abuse Accessibility Features), T1655.001 (Masquerading: Match Legitimate Name or Location), T1629.003 (Impair Defenses: Disable or Modify Tools), T1417.002 (Input Capture: GUI Input Capture), T1636.004 (Protected User Data: SMS Messages), T1513 (Screen Capture), T1512 (Video Capture), T1429 (Audio Capture), T1544 (Ingress Tool Transfer).
Impact for European and Italian companies
Today Hirudo does not target European banks. The point, for ThreatFabric, is the method: a reusable engine that can be retargeted at other apps and other regions, and that moves the contest from the device to the integrity checks inside the app. Anyone developing banking, payment or otherwise sensitive apps can no longer treat signals produced locally by an app that may have been replaced as reliable on their own: signature, list of Accessibility services, Play Integrity verdict. For European banks and payment institutions, this falls within the ICT risk management required by the DORA regulation.
For other companies the risk comes through employees’ phones: a device controlled remotely through Accessibility also exposes business apps, SMS authentication codes and everything that appears on screen.
What to do now
For banks, fintechs and app developers (ThreatFabric’s recommendations):
- Verify Play Integrity and attestation server-side and make the decision there: a valid verdict alone is not enough, because Hirudo relays the requests through its own server. Also check the revocation status of attestation certificates.
- Bind checks to the session and to protected actions, not just to app startup.
- Use Accessibility and screen-capture signals as supporting evidence for risk scoring, not as blockers: a replaced app can hide them.
- Keep behavioural analytics (a lack of behavioural data is itself suspicious) and server-side risk controls at login, credential recovery, beneficiary creation and payment approval.
For IT managers:
- Keep company phones up to date and use your device management system to block installing APKs from unknown sources.
- Have Play Protect scans run periodically.
- Watch for these signals: Accessibility services enabled for unknown apps, banking apps recently reinstalled or “updated” outside the Play Store, shopping or video apps installed from social media links.
How ARXDOME helps
No agent is installed on phones: visibility comes from the network. ARX Watch alerts you when a new or unauthorised device appears on the company network, and ARX Sentry brings firewall logs into the SOC pages, with blocked outbound traffic and sources found on threat lists. With ARX Horizon you can search the portal for published indicators of compromise.
Last updated:
