Hirudo Android malware tricks users with fake bank app updates

Read in: English · Français · Deutsch · Español

Security researchers have spotted a new Android banking trojan that takes a brazen approach: it replaces legitimate banking apps with purpose-built patched copies inside the target device, effectively turning the app’s own security checks against it. Known as Hirudo, the malware uses a hooking engine to bypass the bank app’s built-in protections, including signing certificate checks, Accessibility permissions, and Play Integrity responses.

Hirudo has been observed targeting at least eight Indonesian banking apps, though researchers note the campaign also shows activity against financial institutions in China, India, Mexico, Morocco and Thailand. The attackers spread Hirudo by slipping it into dropper apps that appear legitimate for shopping, adult content, or short drama. Those app types lure users with real content, then trigger a fake “update” prompt that leads to permission prompts and the installation of the patched banking app copy.

Once installed, Hirudo uninstalls the original banking app from the device and proceeds to download a patched version. The malware then uses the app’s own process to run a hooking engine that can clone and alter the app’s behavior. Specifically, the attacker’s code substitutes the genuine signing certificate when queried, hides any enabled accessibility services, and disables screenshot protections so the attacker can view or capture the screen in real time. It can also modify key-attestation certificates and relay Play Integrity checks back to an operator-controlled server, effectively tricking the bank’s defenses.

Beyond bypassing checks, Hirudo is designed for credential theft and full device takeover. It can steal banking passwords, payment PINs, unlock secrets, and SMS messages. It also supports remote control of the infected phone, screen and camera capture, and fake checkout screens that collect PINs before showing a counterfeit success page.

ThreatFabric, which first described Hirudo in detail, notes a serious constraint for defenders: the patched app’s attestation keybox is publicly leaked, and Google lists some certificates as compromised. That means server-side revocation checks can detect forgeries, but it also shows attackers can move fast by reusing leaked materials. The researchers say the damage is amplified by a centralized backend that ties campaigns to stolen data like device status, lock-screen history and financial-risk data.

What this means for everyday users is simple: standard protections may not be enough if your device ends up with a patched banking app. To reduce risk, avoid downloading apps from unofficial stores, keep devices up to date, and run regular Play Protect scans. If you notice unusual behavior around banking apps, unexpected prompts, requests for extra permissions, or unfamiliar update dialogs, treat it as suspicious and reinstall the legitimate app from the official store.

Banks themselves are urged to tighten their integrity and attestation checks server-side, bind verifications to active sessions, and maintain strong transaction-risk controls. The evolving threat shows attackers are moving from device-level tricks to manipulations inside trusted banking apps, making defense a shared challenge for users, app makers, and financial institutions alike.