Mobile threat researchers have uncovered Hirudo, an Android malware that compromises banking security by substituting legitimate financial apps with modified clones that systematically disable protective mechanisms. The malicious versions employ a hooking engine to circumvent app-signature validation, Accessibility service detection, and Play Integrity attestation by either falsifying certificate data or returning blank responses to security queries.
Once deployed on a device, Hirudo grants attackers broad control: credential harvesting, real-time phone manipulation, message interception, screen capture, and audio recording. ThreatFabric, the security firm that documented the campaign, determined that the malware has impersonated at least seven Indonesian financial institutions while also targeting banks across China, India, Mexico, Morocco, and Thailand.
Delivery and installation chain
The malware typically arrives bundled within seemingly legitimate consumer applications—shopping platforms like Shopora, adult-content apps such as 1V1 X, and short-form video services including ZoyaTV and KoiShort. These host applications function as loaders, triggering a counterfeit system update notification that prompts users to grant permissions, particularly access to Accessibility services.
Following permission approval, Hirudo initiates the target banking app's uninstaller, fetches a patched variant, and leverages the granted Accessibility permission to install the compromised version. ThreatFabric notes this installation sequence presents vulnerability windows where users could interrupt the process, making it a risky operation for threat actors.
Technical evasion mechanisms
The patched banking application retains nearly all original functionality while incorporating a hooking engine constructed from the open-source projects YAHFA and Dobby. When executed, this engine performs several evasion techniques:
- Replaces the legitimate signing certificate when security checks request it
- Conceals active Accessibility services from detection
- Strips screenshot protection to enable operator viewing and recording
- Modifies key-attestation certificates and forwards Play Integrity validation requests through attacker infrastructure
According to ThreatFabric, "With the engine running inside the banking app's own process, the app's defenses are turned against it." However, the researchers identified meaningful constraints on these methods: the bundled attestation keybox has been publicly disclosed, and Google has flagged two of its certificates as compromised, enabling server-side revocation checks to identify the forgeries.
Capabilities and impact
Once operational, Hirudo extracts banking passwords, transaction PINs, device unlock codes, and SMS communications. The malware streams device displays to operators and grants camera access. Fake payment interfaces collect PINs while displaying fraudulent success confirmations to mask the theft.
ThreatFabric's investigation uncovered thousands of stolen application credentials stored in an unprotected backend interface, alongside device identifiers, lock-screen data, and financial profiles. The total number of compromised users remains undetermined.
The researchers characterize this campaign as a significant shift in Android banking malware tactics: "Hirudo marks a deliberate escalation in how Android bankers approach hardened applications," moving beyond device-level integrity verification toward exploiting the security layers embedded within banking software itself.
Defensive recommendations
ThreatFabric advises financial institutions to implement server-side validation of app integrity and attestation results, tie security checks to specific sessions and sensitive operations, and maintain behavioral monitoring alongside transaction-risk assessment.
For Android users, security guidance includes maintaining current system patches, avoiding APK installation from third-party app stores, and running periodic Play Protect security scans.