Hirudo Android Trojan Swaps Out Your Banking App From the Inside
A newly identified Android banking trojan called Hirudo takes a nastier approach than most: rather than overlaying fake login screens on top of legitimate apps, it uninstalls them entirely and replaces them with trojanized copies it controls from within.
ThreatFabric, which tracked and analysed the malware, describes it as a hybrid between a traditional banking trojan and a fully functional remote access tool. That means on-device credential theft running in parallel with live remote control, giving attackers a remarkably comprehensive view of a compromised phone. They get real-time screen access via WebRTC, remote camera feeds from both front and rear, and full device interaction through Android Accessibility Services.
The infection chain starts with a dropper disguised as something mundane: a shopping app, an adult video player, or a short-drama streaming app promoted through social media. Once the victim installs it, the dropper checks whether Hirudo is already present. If not, it fetches and installs the payload.
Hirudo currently has eight Indonesian banking apps in its sights, though internal code references suggest the operation has broader ambitions spanning China, India, Mexico, Morocco and Thailand. Once it identifies which banking app is on the device, it displays a fake update prompt, uninstalls the real thing, and drops its own modified version in its place.
That replacement app is where things get genuinely clever and genuinely dangerous. It contains a hooking engine designed to neutralise integrity checks from the inside. When Android asks the app for its signing certificate, the hook substitutes the legitimate one, hiding the fact the app was signed with a test key. When the app queries whether any Accessibility services are active, the hook returns an empty list, keeping the malicious controlling service invisible. The researchers put it plainly: Hirudo moves its tampering inside the target app itself, shifting the battleground from the device level to the app's own integrity mechanisms.
On top of that, it harvests SMS messages with a 90-day initial lookback window, filters for messages from banks and payment services, and maintains persistent remote access throughout.
For banks, the implications are uncomfortable. Signals that come from inside a replaced app simply cannot be trusted at face value. ThreatFabric's advice to financial institutions boils down to four things. First, verify Play Integrity server-side rather than taking a local verdict at face value. Hirudo routes its own integrity requests through an attacker-controlled server, so a clean result means nothing if it's not cross-checked. Second, layer behavioural analytics on top of device signals. Anomalous or absent behaviour is itself a red flag. Third, treat Accessibility and screen-capture signals as risk inputs rather than hard blockers, since a replaced app can hide its own Accessibility service from detection. Fourth, keep backend transaction controls in place at every sensitive step, from login through to payment approval. A forged local result cannot substitute for a decision made server-side.
What Hirudo represents is a deliberate step up in sophistication. By moving the manipulation inside the target application rather than bolting it on externally, the authors have built something more reusable, more adaptable, and considerably harder to detect with conventional on-device checks.