Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Cybersecurity researchers have uncovered a new Android banking trojan named Hirudo, which represents a significant escalation in financial fraud. This malware operates by replacing legitimate banking apps with tampered versions that are designed to bypass security checks from within the app itself. This method marks a new level of sophistication in the way financial fraud is conducted, as it allows the malware to evade detection and carry out its malicious activities more effectively. The Dutch mobile security company ThreatFabric has identified that Hirudo targets eight Indonesian banking apps, but its credential theft capabilities extend to users in countries like Indonesia, China, India, Mexico, Morocco, and Thailand. The malware combines several malicious functions, including credential theft, device takeover, screen and camera capture, and SMS theft, all supported by a mature backend infrastructure. Hirudo is delivered through dropper apps disguised as shopping, adult video, and entertainment applications. These apps carry the trojan as a separate installation package, which is presented as an in-app update. Some of these dropper apps include Shopora, 1V1 X, KoiShort, and ZoyaTV. The dropper apps appear legitimate by loading real content, but they run a startup routine that collects data and checks if the Hirudo RAT is installed. If Hirudo is not already installed, the dropper app displays a fake update prompt to initiate the installation of the malware. Hirudo is installed as a second app and requires its own permissions to function. The malware employs an anti-detection technique by configuring a non-functional VPN connection to block internet access, aiming to prevent cloud-based checks by services like Google Play Protect. Despite these efforts, Play Protect can still provide offline detection for known harmful applications, meaning the anti-detection technique does not completely disable protection. The dropper app is also capable of serving fake screens to capture sensitive information like payment PINs and login credentials. It can even facilitate total remote control of the infected device. A standout feature of Hirudo is its ability to replace target banking apps with tampered copies. These replacements include a hooking engine that bypasses signature, accessibility, screen-capture, and Play Integrity checks. The malware detects installed banking apps through accessibility services and replaces them with malicious versions by uninstalling the genuine app and installing the tampered one. The operation of Hirudo relies on a backend that manages device control and campaigns, handling stolen data such as device records and financial profiles. This approach marks a shift in how Android banking trojans operate, moving from device-level attacks to targeting the integrity checks of the applications themselves. This development highlights the need for server-side verification of app signals and integrity verdicts to counteract such sophisticated threats.