Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with modified versions to steal credentials.
Run Play Integrity?
Get an email when a reviewed story names Play Integrity, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A new Android malware named Hirudo is stealing banking credentials by replacing legitimate banking applications with modified versions that disable security checks. It uses a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks, and can also remotely control infected phones, capture screenshots, and record audio. The malware is typically delivered through seemingly legitimate shopping, adult content, or short drama apps.
The lesson from this incident
Full lessonThe Hirudo malware exploits users' trust in seemingly legitimate apps distributed outside official channels, replacing genuine banking applications with trojanized versions that disable integrity and signature checks. By leveraging a hooking engine, it neutralizes Android's built-in security mechanisms — including Play Integrity API — rendering platform-level protections ineffective once the malicious app is installed. This attack highlights how social engineering through fake shopping, adult, or entertainment apps can serve as a delivery vector for sophisticated banking trojans. The ability to remotely control devices, capture screenshots, and record audio means the breach extends far beyond credential theft, exposing users to comprehensive surveillance. Organizations and consumers alike must treat app sourcing and device configuration hygiene as critical security controls.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
- malware — Hirudo