Hirudo Trojan Swaps Out Your Banking App With a Fake One That Passes Its Own Security Checks
A newly identified Android banking trojan called Hirudo is doing something that should make mobile security engineers uncomfortable: it replaces legitimate banking apps with purpose-built counterfeits designed to defeat the target app's own internal security checks. Not the device's checks. The app's.
ThreatFabric, a Dutch mobile security firm, published details of the operation this week. Researchers found modified versions of eight Indonesian banking apps, while the credential-harvesting side of the operation reaches into Indonesia, China, India, Mexico, Morocco, and Thailand.
According to ThreatFabric VP of fraud engineering Eward Driehuis, the package combines credential theft, live device takeover, screen and camera capture, and SMS interception, backed by what he called a "fairly mature" backend infrastructure.
The trojan arrives via dropper apps posing as shopping platforms, adult video sites, and short-drama entertainment services. The droppers load real content through a WebView to maintain the illusion of legitimacy, while quietly running a background routine to check whether Hirudo's RAT component is already present and whether its accessibility service and notification permissions are active. If not, a fake in-app update prompt appears and the installation begins.
Hirudo itself lands as a second, separate app. It needs its own permissions granted before it can do anything. That's a real friction point for the attackers, but they appear willing to work around it.
The operation also borrows an anti-detection trick previously seen in StreamRat: cutting off internet access by forcing a deliberately broken VPN connection before the payload installs. The goal is to prevent cloud-based checks, including Google Play Protect's online scanning, from analysing the incoming payload. ThreatFabric is careful to note this doesn't kill Play Protect entirely, since offline detection still functions. The technique is better understood as noise reduction than a clean bypass.
Depending on which dropper app is used, the malware can also throw up fake overlays to harvest payment PINs and banking credentials, display bogus lock screen prompts, and hand operators full remote control of the infected device.
None of that is especially novel. What is novel is the app replacement mechanism.
When Hirudo identifies one of the eight targeted Indonesian banking apps, it checks the installed version's signing certificate against a stored reference. Then it displays a fake update prompt, quietly opens Android's uninstaller for the genuine app without waiting for user confirmation, and simultaneously downloads the bank-specific counterfeit. The user ends up with what looks like their banking app but is actually a tampered copy running a hooking engine underneath.
That hooking engine is the interesting part. It intercepts and manipulates several security mechanisms from inside the app itself. Signature verification returns the genuine certificate. Queries for active accessibility services return an empty list. The FLAG_SECURE flag gets stripped, so screens can be viewed and recorded remotely. Key-attestation certificates are re-signed using a publicly leaked keybox, and Play Integrity requests get relayed over plain HTTP to an operator-controlled server that hands back a clean verdict.
ThreatFabric flags two things defenders should pay attention to. First, the keybox used isn't something the operators generated themselves, it's a known leaked one. Second, because the Integrity verdict is relayed rather than genuinely generated, a valid-looking Play Integrity response cannot be taken as proof that an app is untampered. That's a fairly significant caveat for any banking app relying on that signal as a trust anchor.
Distribution appears to run through fake Google Play Store landing pages for shopping, football, and short-drama apps, with users funnelled toward those pages via ads on Meta platforms.
The backend supporting all of this manages campaigns, stolen data, and device records, including lock-screen history and financial profiles with monthly income and risk-score fields. Whoever built this put some thought into the operational side.
ThreatFabric's broader point is worth sitting with: once an app can be replaced with a functionally identical malicious copy, every signal that app produces locally, its certificate, its accessibility list, its integrity verdict, has to be treated as potentially attacker-controlled. Verification needs to happen server-side, not inside the app itself.
This follows ThreatFabric's report last month on StreamRat, which targeted Spanish-speaking users through Meta and TikTok ads impersonating a free streaming service. StreamRat combined VNC-style remote control, hidden-screen access, keylogging, and credential-stealing overlays. Hirudo is a step beyond that. The attack surface has moved inside the target application.