banking trojan2 articles
Hirudo Android Trojan Swaps Out Your Banking App From the Inside
Hirudo is a sophisticated Android banking trojan that combines remote access capabilities with an unusual tactic: it detects legitimate banking apps on a victim's device, uninstalls them, and replaces them with trojanized copies that neutralize security checks from within the app itself. Delivered via convincing dropper apps promoted on social media, it currently targets eight Indonesian banking apps and can steal credentials, provide live remote device control, and collect SMS messages. Security researchers at ThreatFabric warn that this approach — moving tampering inside the target app rather than attacking the device externally — represents a significant escalation, and advise financial institutions to enforce integrity checks server-side and rely on layered behavioral analytics rather than trusting signals generated locally on the device.
Ousaban Banking Trojan Is Hunting Iberian Bank Customers via Fake PDF Lures
Ousaban, a Brazilian banking trojan also known as Javali, is targeting Windows users in Spain and Portugal through phishing PDFs that trick victims into downloading malware hidden inside an image file using steganography. Once installed, it monitors banking activity, capturing keystrokes and screenshots, and gives attackers remote control to hijack live banking sessions at over two dozen Iberian banks. The campaign uses geofencing to restrict delivery to genuine targets in the two countries, and evades detection through a rotating daily command server address and a custom encryption scheme that has proved resilient for years.