Mobile security company ThreatFabric has described a new Android banking trojan called Hirudo that takes an unusual route past banking-app defenses: instead of fighting them, it replaces the app. After a victim installs a loader app and grants permissions, Hirudo launches the uninstaller for the real banking app, downloads a patched copy, and uses the Accessibility permission to install it. ThreatFabric found rigged copies of eight banking apps. The patched app keeps nearly all of the original code but adds a hooking engine, built on the open-source YAHFA and Dobby frameworks, that runs inside the app itself.
From there the app’s own checks are turned against it. According to the researchers, the hooks supply the genuine signing certificate when the app asks for it, hide enabled Accessibility services, remove screenshot protection so the screen can be streamed and recorded, and relay Google Play Integrity requests through a server the operators control. With that in place Hirudo can capture banking passwords, payment PINs, device-unlock secrets and SMS messages, and give operators access to both cameras. Its fake checkout pages collect a payment PIN and then show a made-up “payment successful” screen. ThreatFabric has seen it impersonate at least seven Indonesian banks, with targets also in China, India, Mexico, Morocco and Thailand. Its operators’ backend panel was left unsecured and held thousands of credential entries, but the true victim count is unknown. The researchers note one weakness: the attestation key it bundles has leaked and Google lists two of its certificates as compromised, so a bank that checks attestation server-side can spot the forgery.
How to check if you’re affected
Affected devices are Android phones where one of the loader apps ThreatFabric names was installed: Shopora (shopping), 1V1 X (adult content), or ZoyaTV and KoiShort (short drama). These present a fake “update” prompt that leads to permission requests, including Accessibility. Look through your installed apps for those names, and check Settings > Accessibility for services you do not recognize. If you find them, remove the apps, then contact your bank from a separate device, and change banking passwords and PINs. Treat a banking app that was reinstalled without you asking as suspect. Install banking apps only from the official store, avoid APK files from unofficial sources, and run Play Protect scans, as BleepingComputer’s report recommends.