[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhE-_nri0f-vJDHuHCz3LykT_DzVRwKObv-MlTnJ0m8c":3},{"article":4,"iocs":42,"watch_terms":46,"solutions":47,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"9b9c336f-6b1d-4859-bcd3-abcbf0c634f2","Hirudo Android malware replaces banking apps to evade security checks","hirudo-android-malware-replaces-banking-apps-to-evade-security-checks-7a5799","A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]","A new Android malware named Hirudo is stealing banking credentials by replacing legitimate banking applications with modified versions that disable security checks. It uses a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks, and can also remotely control infected phones, capture screenshots, and record audio. The malware is typically delivered through seemingly legitimate shopping, adult content, or short drama apps.","Hirudo Android malware replaces banking apps with modified versions to steal credentials.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhirudo-android-malware-replaces-banking-apps-to-evade-security-checks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F14\u002Fandroid.jpg","2026-10-14T11:41:20+00:00","2026-10-14T12:00:11.017992+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Play Integrity","product",{"name":21,"type":22},"Accessibility services","technology",{"name":24,"type":22},"hooking engine",{"name":26,"type":19},"YAHFA",{"name":28,"type":19},"Dobby","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,37],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":33,"value":44,"context":45},"Hirudo","Name of the Android malware.",[18,26,28],{"controls":48,"vendors":133},[49,78,104],{"slug":50,"name":51,"problem":52,"products":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,91,96],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":92,"product_name":93,"url":94,"description":95},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":105,"name":106,"problem":107,"products":108},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"hirudo-malware-swaps-banking-apps-to-steal-credentials-and-bypass-security","Hirudo Malware Swaps Banking Apps to Steal Credentials and Bypass Security","The Hirudo malware exploits users' trust in seemingly legitimate apps distributed outside official channels, replacing genuine banking applications with trojanized versions that disable integrity and signature checks. By leveraging a hooking engine, it neutralizes Android's built-in security mechanisms — including Play Integrity API — rendering platform-level protections ineffective once the malicious app is installed. This attack highlights how social engineering through fake shopping, adult, or entertainment apps can serve as a delivery vector for sophisticated banking trojans. The ability to remotely control devices, capture screenshots, and record audio means the breach extends far beyond credential theft, exposing users to comprehensive surveillance. Organizations and consumers alike must treat app sourcing and device configuration hygiene as critical security controls.",[139,140,141,142,143,144,145,146,147,148],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-163 – Vetting the Security of Mobile Applications","NIST CSF PR.AT-1 – Awareness and Training","NIST CSF DE.CM-4 – Malicious Code Detection","GDPR Article 32 – Security of Processing (for organizations handling user banking data)","OWASP Mobile Top 10 – M1: Improper Platform Usage","OWASP Mobile Top 10 – M8: Code Tampering","NIST SP 800-124 – Guidelines for Managing the Security of Mobile Devices in the Enterprise",{}]