Hirudo Android Banking Trojan Replaces Legitimate Apps to Bypass Security Checks

Disclosed on October 14, 2026, by Dutch mobile security firm ThreatFabric, Hirudo represents a notable tactical shift in mobile financial fraud. Rather than merely drawing fake login overlays on top of a genuine application or fighting external device-level protections, Hirudo uninstalls the target's real banking app and swaps in a patched version containing an embedded hooking engine. Once inside the application's own process, the malware forces the app to lie to itself about its digital signature, active accessibility permissions, and device integrity checks.

For enterprise mobile administrators, application security architects, and everyday users who manage their finances from a smartphone, Hirudo is a textbook reminder of why client-side security signals cannot be trusted in isolation.

The Hirudo Attack Chain: From Short Dramas to App Replacement​

Like most modern mobile trojans, Hirudo does not arrive announcing its intentions. According to reporting by BleepingComputer and The Hacker News citing ThreatFabric’s research, the campaign relies on social engineering and malvertising. Unsuspecting users are steered toward fraudulent websites masquerading as Google Play Store landing pages, often driven there by advertisements placed on Meta-owned social media platforms. (It is worth noting that this reflects how the lures were promoted, not evidence that Google Play itself distributed the trojanized apps.)

The initial lures are functional dropper applications posing as shopping storefronts, adult video platforms, football apps, or short-drama streaming services. Because these apps load real content inside a WebView—such as an actual storefront or video catalog—the user experience feels completely legitimate on the surface.

Researchers identified several specific dropper packages used in these campaigns:

(Note: While these package names are confirmed indicators from the research, they are examples from observed campaigns rather than an exhaustive list of every lure in circulation.)

The Dropper Routine and the VPN Blindfold​

While the user browses shopping deals or watches drama clips, the dropper executes a background startup routine. It gathers promotion-tracking metrics, reaches out for its campaign configuration, and checks whether the actual Hirudo remote access trojan (RAT) payload is already installed with Notification and Accessibility permissions active.

If the payload is missing, the dropper displays a bogus in-app "update" prompt. Because Hirudo is deployed as a separate second application, the user is guided through prompts to install it and grant it high-risk permissions, most notably Android Accessibility services.

To keep security tools from spoiling the installation, the malware borrows a trick previously seen in the StreamRat trojan: prior to installing the payload, it configures a deliberately non-functional local VPN connection to cut off internet traffic. ThreatFabric assesses that this temporary blackout is designed to interfere with cloud-based reputation and code-analysis checks performed by services like Google Play Protect—though Play Protect retains offline detection capabilities for known harmful apps, meaning the trick only dulls online analysis rather than completely disabling Google's defenses.

The High-Wire Act of Swapping the Banking App​

Once the Hirudo RAT is active with Accessibility access, it watches for specific banking applications. When it detects one of its primary targets, it checks the genuine app’s signing certificate against a stored reference and displays another fake update prompt.

What happens next is a brazen, somewhat fragile sleight of hand:

1. Hirudo launches Android’s built-in uninstaller for the legitimate banking app without waiting for a user tap.
2. In parallel, it downloads a bank-specific, pre-patched replacement APK.
3. Abusing its Accessibility privileges, the malware drives the installation of the modified clone.

ThreatFabric points out that this replacement phase is a delicate constraint for the attackers. Because Android will not allow a modified app with a different cryptographic signature to simply overwrite an authentic app via a standard update, the real app must be removed first. That creates two distinct moments where an attentive user might notice their phone uninstalling and reinstalling their banking app and interrupt the process.

Section Summary: Hirudo uses functional entertainment and shopping apps distributed via fake Play Store pages to trick users into installing a secondary RAT payload. Using Accessibility permissions, the malware uninstalls genuine banking apps and replaces them with modified clones.

Turning the App Against Itself: Inside the Hooking Engine​

Why go through the risky trouble of uninstalling a victim's banking app when traditional screen overlays have worked for years? Because financial institutions have spent the last decade hardening their mobile apps against overlays, screen recording, and accessibility abuse.

Hirudo counters those defenses by moving the battle inside the application’s own memory space. ThreatFabric discovered that the trojanized banking apps keep nearly all of the original application's code intact, but bundle a hooking engine constructed on top of two well-known open-source hooking frameworks: YAHFA and Dobby.

When the victim opens the patched banking app, the hooking engine intercepts internal API calls and security queries in real time:

• Spoofing App Signatures: When the banking app checks its own signing certificate to verify it hasn't been tampered with, the hooking engine intercepts the query and returns the genuine certificate of the original, unmodified app.
• Blinding Accessibility Checks: Many hardened banking apps query the operating system to see if any suspicious Accessibility services are running and refuse to launch if they find one. Hirudo’s engine intercepts this check and returns a clean, empty list.
• Stripping Screen Protection (FLAG_SECURE): Banking apps normally set Android's FLAG_SECURE window flag to block screenshots and screen recording. The hooking engine strips this flag away, allowing the threat actors to stream the victim's screen and record sensitive financial screens remotely.
• Tampering with Key Attestation and Play Integrity: The engine modifies key-attestation certificates by re-signing them with a bundled keybox. Furthermore, when the app attempts a Google Play Integrity check, the request is intercepted and relayed over plain HTTP to an operator-controlled server, which hands back a forged "clean" verdict for the app to accept.

As ThreatFabric’s researchers put it, running the hooking engine inside the banking app's own process turns the application's defenses against itself. Even more concerning for defenders is that this hooking architecture is not a one-off hack for a single bank; it is a reusable engine that can be bolted onto other applications across different regions.

Section Summary: By embedding a YAHFA- and Dobby-based hooking engine directly into cloned banking apps, Hirudo intercepts internal security queries, spoofs original signing certificates, hides active Accessibility services, removes FLAG_SECURE screenshot blocks, and relays Play Integrity checks through attacker servers.

Global Reach, Capabilities, and Backend Exposure​

While the full app-replacement mechanism has so far been observed targeting eight specific Indonesian banking applications (impersonating at least seven Indonesian banks), Hirudo’s broader credential-stealing net is cast much wider. According to ThreatFabric, the malware’s configuration and credential-targeting capabilities span financial institutions across Indonesia, China, India, Mexico, Morocco, and Thailand.

Once Hirudo has a foothold—whether through a replaced banking app or the dropper/RAT combination itself—it functions as a comprehensive surveillance and fraud suite. Its documented capabilities include:

• Credential and PIN Harvesting: Presenting fake login screens for banks and digital wallets, as well as fake checkout pages that request payment PINs before displaying a fabricated "payment successful" screen to keep the victim calm while their account is drained.
• Lock-Screen Capture: Deploying fake pattern and PIN overlays to capture the device’s unlock secrets.
• Live Remote Control and Spyware: Streaming the device screen in real time, capturing audio, accessing both front and rear cameras, and intercepting SMS messages (often used to snag two-factor authentication codes).

[Fake Play Store Page / Meta Ad]
              │
              ▼
[Functional Lure App: Shopora, 1V1 X, KoiShort, ZoyaTV]
              │
              ├─► Configures broken local VPN (blinds online checks)
              └─► Prompts for "In-App Update"
                        │
                        ▼
       [Hirudo RAT Payload Installed] (Grants Accessibility)
                        │
                        ├─► Uninstalls real banking app
                        └─► Installs YAHFA/Dobby patched clone
                                  │
                                  ▼
             [Internal Checks Spoofed & Data Exfiltrated]

During their investigation, ThreatFabric researchers uncovered an unsecured backend panel used by the operators. Inside, they found thousands of stolen application-credential entries alongside detailed device records, lock-screen histories, and victim financial profiles containing fields for monthly income and risk scores. While the exposed panel proves the infrastructure is actively collecting data at scale, the exact number of unique infected victims and confirmed financial losses remains unknown.

Where the Armor Cracks: How Defenders Can Catch Hirudo​

Despite the sophistication of an in-process hooking engine, Hirudo’s evasion tricks have a glaring architectural flaw—one that highlights the difference between client-side theatre and server-side verification.

First, ThreatFabric discovered that the attestation keybox bundled inside Hirudo to re-sign key-attestation certificates is not a private keybox owned by the attackers; it is a publicly leaked keybox. Google already lists two of the certificates from that leaked keybox as compromised. Consequently, any bank backend that performs proper server-side certificate revocation checks can immediately spot the forgery.

Second, relaying Play Integrity requests over plain HTTP to an attacker server only works if the banking application blindly trusts a locally received verdict. Under Google’s Play Integrity architecture and ThreatFabric’s defensive recommendations, client-side signals should never be accepted at face value.

Architectural Takeaways for App Developers and Enterprise Security​

Whether you are building mobile banking software or managing enterprise line-of-business apps that handle sensitive corporate data, Hirudo offers a clear blueprint for hardening mobile architectures:

1. Never Trust the Client in Isolation: Once an application binary is modified and replaced, every locally generated signal—app signature checks, active Accessibility lists, root detection, and client-side integrity verdicts—is under the attacker's thumb.
2. Validate Integrity and Attestation Server-Side: Integrity tokens and hardware-backed key attestation chains must be verified on your backend servers, complete with rigorous checks against Google’s certificate revocation lists.
3. Bind Integrity Checks to Specific Actions: Do not rely on a single startup check or cached integrity verdicts. Bind integrity requests to active sessions and specific high-risk transactions (such as adding a payee or initiating a wire transfer) so replayed or relayed responses fail validation.
4. Use Behavioral and Transaction-Risk Controls as a Safety Net: As ThreatFabric notes in its analysis, even if an attacker blinds client-side flags like FLAG_SECURE or Accessibility checks, behavioral telemetry and server-side transaction monitoring remain vital. If an app suddenly stops sending expected behavioral telemetry, that absence itself should raise the session's fraud risk score.

Practical Guidance for Android Users​

For everyday Android users and enterprise employees using bring-your-own-device (BYOD) phones, staying clear of Hirudo comes down to disciplined installation habits:

• Stick to Official App Stores: Avoid sideloading APK files from third-party websites, even if a webpage looks identical to a Google Play Store listing reached via a social media ad. Open the official Google Play Store app directly on your device to search for apps.
• Treat "In-App Updates" with Extreme Skepticism: Legitimate apps installed through Google Play update through the Play Store, not by popping up browser-style prompts asking you to install a secondary app and grant it Accessibility permissions.
• Guard Accessibility Permissions: An entertainment, shopping, or streaming app has no business asking for Android Accessibility control. If an app demands it to "update" or play video, uninstall it immediately.
• Watch for Unexpected App Removals: If your phone suddenly brings up an uninstall prompt for your banking app—or if your banking app unexpectedly asks to be reinstalled right after an "update"—cancel the action immediately.
• Keep Play Protect and OS Patches Current: Ensure Google Play Protect is enabled, run periodic scans, and keep your Android security patch level up to date.

If you suspect a lure app like Shopora, 1V1 X, KoiShort, or ZoyaTV was installed on your device, or that a banking app was tampered with, do not use that phone to check your balances. Log into your bank from a known clean PC, change your credentials, and contact your financial institution's fraud department through an official number to lock down your accounts.

Section Summary: Hirudo's reliance on a publicly leaked attestation keybox means server-side revocation checks can expose the deception. Developers must verify integrity tokens server-side and bind them to transactions, while users should avoid sideloading APKs from social media ads and reject unexpected Accessibility prompts.