Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Hirudo Android Trojan replaces legitimate banking apps with patched versions to bypass security checks.
Run ThreatFabric?
Get an email when a reviewed story names ThreatFabric, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A new Android banking trojan named Hirudo has been discovered that bypasses security measures by replacing legitimate banking apps with tampered versions. This malware, identified by ThreatFabric, targets eight Indonesian banking apps and also operates in China, India, Mexico, Morocco, and Thailand. It employs a sophisticated backend and combines credential theft, device takeover, and screen/camera capture.
The lesson from this incident
Full lessonThe Hirudo Android trojan bypasses built-in banking app security by replacing genuine apps with tampered, patched versions that appear legitimate to users. This attack exploits user trust in familiar applications and circumvents integrity checks by operating as a modified but superficially authentic clone. The combination of credential theft, device takeover, and screen/camera capture makes this a highly invasive threat with serious financial and privacy consequences. This campaign highlights how mobile users remain a high-value target and how sideloading or supply chain manipulation can undermine even well-designed in-app security controls.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- malware — Hirudo