[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxERoC-dna45dRtJoRwG9sW7yoMn8CSPP05itQb3Deyg":3},{"article":4,"iocs":39,"watch_terms":40,"solutions":41,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"80b938d3-e97e-4744-a798-9af857416a6b","Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies","novel-android-rat-hirudo-replaces-banking-apps-with-trojanized-copies-17a097","The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.","A novel Android malware named Hirudo combines remote access trojan (RAT) and banking trojan functionalities. It operates by replacing legitimate banking applications with modified versions that bypass security checks, enabling credential theft and live remote control of the victim's device. The malware is distributed through dropper apps disguised as genuine content.","New Android RAT 'Hirudo' replaces banking apps with trojanized copies to steal credentials.","https:\u002F\u002Fwww.securityweek.com\u002Fnovel-android-banking-rat-hirudo-replaces-banking-apps-with-trojanized-copies\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002Fandroid-banking-malware.png","2026-10-15T10:15:32+00:00","2026-10-15T12:00:11.98829+00:00",8,[17,20,23],{"name":18,"type":19},"Android Accessibility Services","product",{"name":21,"type":22},"WebRTC","technology",{"name":24,"type":25},"ThreatFabric","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,34],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,18],{"controls":42,"vendors":123},[43,72,98],{"slug":44,"name":45,"problem":46,"products":47},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[48,56,64],{"vendor_slug":49,"vendor_name":50,"vendor_logo":51,"product_slug":52,"product_name":53,"url":54,"description":55},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":73,"name":74,"problem":75,"products":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[77,82,90],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":78,"product_name":79,"url":80,"description":81},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":99,"name":100,"problem":101,"products":102},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[103,110,116],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":99,"product_name":107,"url":108,"description":109},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":120,"url":121,"description":122},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":139},"android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","The Hirudo malware exploits users' inability to distinguish legitimate banking applications from convincing trojanized copies, distributed via dropper apps masquerading as genuine content. By replacing authentic apps with modified versions that bypass security checks, attackers gain both credential theft capabilities and live remote control of compromised devices. This attack chain succeeds primarily because users install applications from unverified sources and lack awareness of mobile app integrity verification. The combination of RAT and banking trojan functionality makes this particularly dangerous, as attackers can intercept multi-factor authentication, exfiltrate credentials, and conduct fraudulent transactions in real time. Organizations and individuals must treat mobile app sourcing and device configuration hygiene with the same rigor applied to endpoint security.",[129,130,131,132,133,134,135,136,137,138],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST AC-3: Access Enforcement","NIST SI-3: Malicious Code Protection","NIST SA-12: Supply Chain Protection","GDPR Article 32: Security of Processing (for organizations handling EU user data via mobile apps)","OWASP Mobile Top 10: M1 - Improper Platform Usage, M8 - Code Tampering","ITIL: Service Configuration Management (ensuring only authorized software runs in managed environments)",{}]