[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUuIyvSC_KtsyY3mneY6ON0svMkx6DX8QqgChRdlMu3Q":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"af716ded-b1d1-47dc-81e7-8de1889effb1","android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","80b938d3-e97e-4744-a798-9af857416a6b","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","The Hirudo malware exploits users' inability to distinguish legitimate banking applications from convincing trojanized copies, distributed via dropper apps masquerading as genuine content. By replacing authentic apps with modified versions that bypass security checks, attackers gain both credential theft capabilities and live remote control of compromised devices. This attack chain succeeds primarily because users install applications from unverified sources and lack awareness of mobile app integrity verification. The combination of RAT and banking trojan functionality makes this particularly dangerous, as attackers can intercept multi-factor authentication, exfiltrate credentials, and conduct fraudulent transactions in real time. Organizations and individuals must treat mobile app sourcing and device configuration hygiene with the same rigor applied to endpoint security.","**Immediate actions:**\n- Install applications exclusively from official app stores (Google Play) and verify publisher identity before downloading any banking or financial app.\n- Enable Google Play Protect on all Android devices to continuously scan for malicious or modified applications.\n\n**Long-term improvements:**\n- Enforce Mobile Device Management (MDM) policies that restrict sideloading and require app allowlisting on corporate and BYOD devices.\n- Conduct regular security awareness training focused on mobile phishing, dropper apps, and the risks of installing apps from third-party sources.\n- Implement app integrity verification and code-signing validation as part of any enterprise mobile application deployment pipeline.\n\n**Detection measures:**\n- Monitor for anomalous device behavior such as unexpected accessibility service permissions or overlay activity indicative of banking trojans.\n- Deploy Mobile Threat Defense (MTD) solutions to detect runtime tampering, app replacement, and suspicious RAT-like communications on managed devices.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-124: Guidelines for Managing the Security of Mobile Devices","NIST AC-3: Access Enforcement","NIST SI-3: Malicious Code Protection","NIST SA-12: Supply Chain Protection","GDPR Article 32: Security of Processing (for organizations handling EU user data via mobile apps)","OWASP Mobile Top 10: M1 - Improper Platform Usage, M8 - Code Tampering","ITIL: Service Configuration Management (ensuring only authorized software runs in managed environments)",{},"published","2026-10-15T12:21:08.93967+00:00","2026-10-15T12:21:08.907+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fnovel-android-banking-rat-hirudo-replaces-banking-apps-with-trojanized-copies\u002F","novel-android-rat-hirudo-replaces-banking-apps-with-trojanized-copies-17a097","Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]