Hirudo Android Banking Trojan Replaces Genuine Banking Apps With Patched Copies
Do Son 
At a Glance
| Malware Family | Hirudo banking trojan (Android remote access trojan and app-patching toolkit) |
| Threat Actor | Unattributed financially motivated group (Chinese-language backend panel observed; identity unconfirmed) |
| Target / Victims | Thousands of compromised device records; 8 patched apps across 7 Indonesian banks, plus 42 financial targets across China, India, Malaysia, Mexico, Morocco, and Thailand |
| Delivery Vector | Social media advertisements leading to Amazon CloudFront dropper apps (Shopora, 1V1 X, ZoyaTV, KoiShort) |
| Key Capabilities | Banking app replacement, YAHFA and Dobby code hooking, Play Integrity relay, WebRTC live screen streaming, SMS and lock-screen theft |
| Sources | ThreatFabric Mobile Threat Intelligence |
TL;DR
ThreatFabric researchers identified a new Android Hirudo banking trojan that uninstalls real mobile banking applications and replaces them with modified versions. Once installed, the Hirudo banking trojan uses an internal hooking engine to blind signature, Accessibility, and Google Play Integrity checks. Furthermore, an exposed backend server analyzed in August 2026 held thousands of stolen credential and device records.
Delivery and Attribution
The campaign spreads through social media advertisements themed around football, shopping, adult videos, and short dramas. Specifically, victims download functional lure applications such as Shopora, 1V1 X, ZoyaTV, and KoiShort. Operators host these malicious packages on Amazon CloudFront and track installations using OpenInstall attribution links and Meta Pixel identifiers. Several of these CloudFront download routes remained active in October 2026.
Confirmed Versus Suspected Attribution
Security researchers have not linked this operation to a known threat group. Therefore, confirmed attribution does not apply to this campaign. However, suspected attribution points to a Chinese-speaking cybercrime syndicate. Specifically, an unauthenticated APK-processing panel uncovered during the investigation displayed Chinese-language interface controls and labels. In addition, the malware targets 42 financial applications across Indonesia, China, India, Malaysia, Mexico, Morocco, and Thailand. Meanwhile, backend data captured in August 2026 exposed thousands of stolen credential entries and financial profiles.
Infection Chain
The malware operates using a two-stage installer design. First, the victim installs a branded dropper app that loads real shopping or video content inside a browser view. In the background, the dropper checks whether the main payload is already present on the phone. If the payload is missing, the dropper shows a fake in-app update prompt to install the bundled Android Hirudo banking trojan package. Notably, the Shopora shopping dropper also starts a local blackhole VPN to cut IPv4 internet traffic during installation.
Replacing Genuine Banking Apps
While the malware tracks 42 financial apps, it carries dedicated replacement packages for eight Indonesian banking apps across seven banks. According to the ThreatFabric research report, “What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.”
Because the replacement app uses a public Android test key, the operating system cannot install it as a standard update. Consequently, the trojan abuses Accessibility permissions to open the system uninstaller and remove the real banking app first. At the same time, it downloads the modified banking package and guides the installer through the permission screens. Inside the patched app, a single injected line of code loads the YAHFA Java hooking framework and the Dobby native hooking library. This engine activates only when a specific trigger file created by the trojan exists on the device.
Once active, the hooks falsify internal security checks. When the banking app checks its digital signature, the hook returns the genuine bank certificate instead of the test key. Similarly, the hook returns an empty list when the app checks for active Accessibility services. It also strips the screen-capture protection flag and relays Google Play Integrity checks over plain HTTP to an operator server.
Command-and-Control and Data-Exfiltration Behavior
Beyond app replacement, the Hirudo banking trojan steals credentials through multiple overlays. When a user attempts a purchase inside a shopping lure, the payload displays a transparent checkout page localized into eight languages. It then uploads the entered payment PIN to the command server and shows a fake payment success message. Furthermore, the malware displays fake lock-screen overlays and reads real lock-screen PINs, passwords, and patterns directly through Accessibility services.
Operators also gain live remote control over infected phones. Specifically, the payload streams the device screen over WebRTC, activates the front and rear cameras, and steals SMS messages from the past 90 days. All stolen credentials, lock-screen histories, and monthly income estimates flow into a central management backend.
Defense and Detection Guidance
Because the Android Hirudo banking trojan alters code inside the banking application, banks cannot trust client-side security signals alone. As ThreatFabric warned, “Both facts point to the same conclusion: once an app can be replaced, its locally produced signals, signature, Accessibility list, integrity verdict, must be treated as attacker-influenced and verified server-side.” Fortunately, researchers found that the attackers forged key-attestation checks using a publicly leaked keybox. Because Google already listed at least two of those certificates on its revocation list, backend servers that check revocation status can catch the forgery.
Financial institutions must verify Play Integrity verdicts on the backend and bind them to specific user sessions and actions. Additionally, banks should deploy behavioral analytics to spot unusual navigation or missing telemetry during live sessions. Finally, Android users should avoid installing applications from social media links and never grant Accessibility permissions to unverified updates.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
