[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f27XHOR5eA_1USbjtu9ITTfYvf_2OsTLR7_p627wRTRw":3},{"article":4,"iocs":39,"watch_terms":43,"solutions":44,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"6b7a5e8a-29be-45b4-be25-4fbad2adc839","Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks","hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-securit-a95ca0","Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking","A new Android banking trojan named Hirudo has been discovered that bypasses security measures by replacing legitimate banking apps with tampered versions. This malware, identified by ThreatFabric, targets eight Indonesian banking apps and also operates in China, India, Mexico, Morocco, and Thailand. It employs a sophisticated backend and combines credential theft, device takeover, and screen\u002Fcamera capture.","Hirudo Android Trojan replaces legitimate banking apps with patched versions to bypass security checks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhirudo-android-trojan-uses-patched.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj010OXrg2ZBrxwqSnpzd8SrIDY_dYOMtdnzIpG7YnCjv1QB58_HylDTkfFmXtZYci90doRcSrPdFfYLowM_S5t2RpD6UkCoWveJrKajQS-7d3sDtyI22FYN0TKy-pQpzWScUB_ROhXRNzZi9dzhgg02kH3WVtdGPNWYBLKv8qZgsa9kREW1SvZ2LTF2AWV\u002Fs1600\u002Fandroid-banking.jpg","2026-10-14T11:08:22+00:00","2026-10-14T12:00:06.384658+00:00",8,[17,20,23],{"name":18,"type":19},"ThreatFabric","vendor",{"name":21,"type":22},"Android","technology",{"name":24,"type":25},"Google Play Protect","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,34],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40],{"type":30,"value":41,"context":42},"Hirudo","Name of the Android banking trojan",[18,24],{"controls":45,"vendors":119},[46,67,93],{"slug":47,"name":48,"problem":49,"products":50},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[51,59],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":68,"name":69,"problem":70,"products":71},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":89,"product_name":90,"url":91,"description":92},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":94,"name":95,"problem":96,"products":97},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[98,106,111],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":107,"product_name":108,"url":109,"description":110},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":135},"hirudo-trojan-replaces-legitimate-banking-apps-to-steal-credentials","Hirudo Trojan Replaces Legitimate Banking Apps to Steal Credentials","The Hirudo Android trojan bypasses built-in banking app security by replacing genuine apps with tampered, patched versions that appear legitimate to users. This attack exploits user trust in familiar applications and circumvents integrity checks by operating as a modified but superficially authentic clone. The combination of credential theft, device takeover, and screen\u002Fcamera capture makes this a highly invasive threat with serious financial and privacy consequences. This campaign highlights how mobile users remain a high-value target and how sideloading or supply chain manipulation can undermine even well-designed in-app security controls.",[125,126,127,128,129,130,131,132,133,134],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","NIST SP 800-163: Vetting the Security of Mobile Applications","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-4: Malicious code is detected","OWASP Mobile Top 10: M8 - Code Tampering","OWASP Mobile Top 10: M9 - Reverse Engineering","GDPR Article 32: Security of Processing (for organizations handling EU user data)","ISO\u002FIEC 27001 A.12.2: Protection from malware","PCI DSS Requirement 5: Protect all systems against malware",{}]