Ethical Hacking News
The Hirudo Android Trojan is a highly sophisticated banking app replacement malware that has been identified by researchers. This malware employs a stealthy approach, replacing genuine banking apps with modified versions, and bypassing security checks to steal sensitive credentials. The malware's operation is facilitated by its use of Amazon CloudFront, tied to campaign tracking through OpenInstall attribution, and linked to Meta Pixel IDs connecting specific branding to specific campaign groups. The malware represents a significant escalation in the sophistication of Android banking malware, highlighting the need for users and security experts to treat signals produced locally by an app that may have been replaced as attacker-influenced and verified server-side.
Hirudo is a highly sophisticated Android banking trojan that can replace genuine banking apps to steal sensitive credentials. The malware employs a stealthy approach, replacing the real app with a modified copy and loading real content through a WebView to deceive users. The malware creates a deliberately broken VPN connection to weaken online reputation checks and code analysis. The malware's attack vector targets financial apps, with eight Indonesian banking apps already having specially designed replacements ready. The malware's credential-stealing code targets users in six countries, and its replacement app appears harmless with only one line of code added to the app's Application class. ThreatFabric researchers have highlighted two critical points regarding the malware: the leaked keybox and the vulnerability in Play Integrity responses. The malware's operation is facilitated by its use of Amazon CloudFront, OpenInstall attribution, and Meta Pixel IDs. The malware's records include thousands of credential entries, device records, lock-screen history, and financial profiles with monthly income and risk score fields.
The threat landscape in the realm of mobile security has recently been elevated with the emergence of a novel Android banking trojan known as Hirudo. This highly sophisticated malware has been identified by researchers as a replacement for genuine banking apps, with the ultimate goal of stealing sensitive credentials and bypassing security checks. The malware's approach differs significantly from traditional Android banking trojans, which typically overlay a fake login screen over the real app.
Instead, Hirudo employs a more stealthy approach, wherein it uninstalls the real app and replaces it with a modified copy. This malicious APK is delivered as a second app hidden inside a convincing dropper, often masquerading as a legitimate shopping app, short drama platform, or adult video service. The dropper loads real content through a WebView to make the app appear genuine, thereby deceiving users into installing the malicious APK.
Upon installation, Hirudo creates a deliberately broken VPN connection that cuts off the device's internet access while the malware is being installed. This technique is designed to weaken online reputation checks and code analysis, allowing the malware to remain undetected. The payload then obtains its own Accessibility and notification permissions, further increasing its ability to operate undetected.
The malware's attack vector involves targeting financial apps, with eight Indonesian banking apps from seven banks already having specially designed replacements ready. The malware's credential-stealing code targets users in Indonesia, China, India, Mexico, Morocco, and Thailand. The malware's replacement keeps the original package name and version number, but is signed with a public test key rather than the bank's real certificate, thereby allowing it to bypass Android's security checks.
The malware's replacement app appears to be harmless, with only one line of code added to the app's Application class. This line loads a built-in hooking engine when the app starts, which uses two open-source frameworks to modify Java methods and native functions. The engine activates only when it finds a trigger file created by the RAT on the device, thereby enabling the malware to control how the banking app responds to security checks.
ThreatFabric researchers have highlighted two critical points regarding the malware. Firstly, the keybox used for attestation has been leaked publicly, and at least two of its certificates are already on Google's revocation list. Secondly, a valid Play Integrity response does not prove that the app has not been tampered with, as the response can be relayed through the operator's server rather than generated through a genuine integrity check.
The malware's operation is further facilitated by its use of Amazon CloudFront, tied to campaign tracking through OpenInstall attribution, and linked to Meta Pixel IDs connecting specific branding to specific campaign groups. Some download routes were still live through late September and into October 2026, highlighting a significant operational security failure that allowed researchers to map the operation.
Records from August 2026 included thousands of credential entries split across campaign groups, device records, lock-screen history, and financial profiles with monthly income and risk score fields. The operators annotated records they considered "phished," which signals a workflow built to convert stolen data into actual fraud rather than just collect it.
In conclusion, the Hirudo Android Trojan represents a significant escalation in the sophistication of Android banking malware. By moving its tampering inside the target app, the operation shifts the contest from the device to the application's own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions. This highlights the need for users and security experts to treat signals produced locally by an app that may have been replaced as attacker-influenced and verified server-side, rather than relying solely on locally produced signals.
Related Information:
https://www.ethicalhackingnews.com/articles/Hirudo-Android-Trojan-A-Sophisticated-Banking-App-Replacement-Malware-ehn.shtml
https://securityaffairs.com/200970/malware/hirudo-android-trojan-replaces-banking-apps-to-steal-credentials.html
Published: Thu Oct 15 03:12:04 2026 by llama3.2 3B Q4_K_M
