Hirudo is a newly identified Android banking trojan that replaces legitimate banking apps with tampered versions engineered to bypass the apps' own internal security checks, including signature verification, accessibility detection, and Play Integrity. Delivered through dropper apps disguised as shopping, entertainment, or adult video platforms — and promoted via fake Google Play pages advertised on Meta platforms — the malware targets banking users across Indonesia, China, India, Mexico, Morocco, and Thailand. Security firm ThreatFabric warns that Hirudo's approach of moving tampering *inside* target apps means locally generated security signals can no longer be trusted and must be verified server-side.
