[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwcog2HjCVmNmTgQlLMagfuwp-sPL84aiNC_T383n718":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"4d2cea21-2a56-4d4a-b14d-44737680f1cb","hirudo-trojan-replaces-legitimate-banking-apps-to-steal-credentials","6b7a5e8a-29be-45b4-be25-4fbad2adc839","Hirudo Trojan Replaces Legitimate Banking Apps to Steal Credentials","The Hirudo Android trojan bypasses built-in banking app security by replacing genuine apps with tampered, patched versions that appear legitimate to users. This attack exploits user trust in familiar applications and circumvents integrity checks by operating as a modified but superficially authentic clone. The combination of credential theft, device takeover, and screen\u002Fcamera capture makes this a highly invasive threat with serious financial and privacy consequences. This campaign highlights how mobile users remain a high-value target and how sideloading or supply chain manipulation can undermine even well-designed in-app security controls.","**Immediate actions:**\n- Enable Google Play Protect and verify that all installed banking apps originate exclusively from official app stores or bank-verified sources.\n- Remove and reinstall any banking apps from official channels if unexpected behavior, permission changes, or unfamiliar UI elements are observed.\n\n**Long-term improvements:**\n- Implement app attestation and integrity verification (e.g., Google Play Integrity API) within banking apps to detect tampered or repackaged builds at runtime.\n- Enforce Mobile Device Management (MDM) policies that restrict sideloading of apps from unknown sources on employee and BYOD devices.\n- Conduct regular mobile threat landscape reviews and update threat models to include trojanized app delivery as an attack vector.\n\n**Detection measures:**\n- Deploy Mobile Threat Defense (MTD) solutions that can identify anomalous app behavior, unauthorized screen capture, or unexpected accessibility service usage.\n- Monitor for unusual account access patterns or login anomalies that may indicate credential compromise originating from mobile endpoints.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","NIST SP 800-163: Vetting the Security of Mobile Applications","NIST SP 800-124: Guidelines for Managing Mobile Device Security","NIST CSF DE.CM-4: Malicious code is detected","OWASP Mobile Top 10: M8 - Code Tampering","OWASP Mobile Top 10: M9 - Reverse Engineering","GDPR Article 32: Security of Processing (for organizations handling EU user data)","ISO\u002FIEC 27001 A.12.2: Protection from malware","PCI DSS Requirement 5: Protect all systems against malware",{},"published","2026-10-14T12:20:48.436333+00:00","2026-10-14T12:20:48.409+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhirudo-android-trojan-uses-patched.html","hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-securit-a95ca0","Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":56,"name":57,"problem":58},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]