Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
New Android RAT 'Hirudo' replaces banking apps with trojanized copies to steal credentials.
Run ThreatFabric?
Get an email when a reviewed story names ThreatFabric, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A novel Android malware named Hirudo combines remote access trojan (RAT) and banking trojan functionalities. It operates by replacing legitimate banking applications with modified versions that bypass security checks, enabling credential theft and live remote control of the victim's device. The malware is distributed through dropper apps disguised as genuine content.
The lesson from this incident
Full lessonThe Hirudo malware exploits users' inability to distinguish legitimate banking applications from convincing trojanized copies, distributed via dropper apps masquerading as genuine content. By replacing authentic apps with modified versions that bypass security checks, attackers gain both credential theft capabilities and live remote control of compromised devices. This attack chain succeeds primarily because users install applications from unverified sources and lack awareness of mobile app integrity verification. The combination of RAT and banking trojan functionality makes this particularly dangerous, as attackers can intercept multi-factor authentication, exfiltrate credentials, and conduct fraudulent transactions in real time. Organizations and individuals must treat mobile app sourcing and device configuration hygiene with the same rigor applied to endpoint security.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.