Ethical Hacking News
The recent discovery of the Hirudo Android banking Trojan has sent shockwaves through the cybersecurity community, highlighting the increasingly sophisticated methods used by threat actors to bypass security checks and steal sensitive financial information. This article delves into the details of the Hirudo Trojan and explores the ways in which it is being used to facilitate financial fraud, highlighting the need for robust security measures to protect against emerging threats.
The Hirudo Android banking Trojan is a highly sophisticated malware that bypasses security checks to steal sensitive financial information. The malware replaces legitimate banking apps with patched versions to evade security checks, marking a new escalation in financial fraud. The attackers use lure apps to trick victims into installing the malicious dropper app, which then installs the malware. The malware implements anti-detection techniques, including blocking internet access, to prevent detection by security services. The malware facilitates on-device credential theft, live remote control, and SMS theft, targeting multiple regions. The attackers use a publicly leaked keybox to ship the attestation key and relay integrity requests over plain HTTP to an operator-controlled server. The discovery of the Hirudo Trojan highlights the need for robust security measures to protect against emerging threats.
The recent discovery of the Hirudo Android banking Trojan has sent shockwaves through the cybersecurity community, highlighting the increasingly sophisticated methods used by threat actors to bypass security checks and steal sensitive financial information. As the world becomes increasingly dependent on mobile devices, the importance of robust security measures cannot be overstated. In this article, we will delve into the details of the Hirudo Trojan and explore the ways in which it is being used to facilitate financial fraud.
According to Dutch mobile security company ThreatFabric, the Hirudo Trojan is a highly sophisticated malware that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself. This approach marks a new escalation in financial fraud, as it shifts the contest from the device to the application's own integrity checks. The malware is delivered through shopping, adult video, and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.
The attackers use a lure to trick the victim into installing the malicious dropper app. This lure can be a storefront, a video catalogue, or short dramas that look legitimate. Once the dropper app is installed, it runs a fixed startup routine that collects promotion-tracking data, fetches its campaign configuration, and checks whether the payload, the Hirudo RAT, is already installed with its accessibility service and notification access enabled. If it's not present, it displays a fake in-app update prompt to trigger the installation of the malware.
The malware implements an anti-detection technique based on blocking Internet access by configuring a deliberately non-functional VPN connection prior to the payload installation. This is an attempt to prevent other apps and services, like Google Play Protect, from carrying out cloud-based checks of the payload. However, ThreatFabric noted that Play Protect also provides offline detection for known potentially harmful applications, making the mechanism less effective than initially thought.
The malware facilitates on-device credential theft and live remote control, and its operations combine credential theft, device takeover, screen and camera capture, and SMS theft. The malware is designed to work across multiple regions, targeting Indonesian banking apps, Chinese banks, Indian banks, Mexican banks, Moroccan banks, and Thai banks.
The attackers use a publicly leaked keybox to ship the attestation key, which is not the operators' own. They also relay the integrity request over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept. This means that a valid integrity response alone is not evidence of an untampered app.
The entire operation rests on a backend that combines device control with the ability to manage different campaigns and stolen data, including device records, lock-screen history, and financial profiles containing monthly income and risk-score fields. ThreatFabric noted that Hirudo marks a deliberate escalation in how Android bankers approach hardened applications, shifting the contest from the device to the application's own integrity checks.
The discovery of the Hirudo Trojan highlights the need for robust security measures to protect against emerging threats. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and implement the latest security protocols to safeguard sensitive information. In the coming days and weeks, we can expect to see more attacks like Hirudo, as threat actors continue to adapt and evolve their tactics.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-Android-Banking-Trojans-How-Hirudo-is-Revolutionizing-Financial-Fraud-ehn.shtml
https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html
Published: Wed Oct 14 07:38:22 2026 by llama3.2 3B Q4_K_M
