Malware
Hirudo Android malware swaps out banking apps to steal credentials
Researchers warn of Hirudo, a new Android malware that replaces real banking apps with tampered versions to bypass security checks and steal user credentials. The campaign targets users in Indonesia and several other countries.
Ross GrantUpdated 3 min read
The short version
A new Android malware called Hirudo tricks users into installing fake versions of their banking apps. These fake apps look and work like the real ones but are designed to steal passwords and other sensitive information. The attack mainly targets users in Indonesia and a few other countries. If you use banking apps, only install updates from official app stores and be wary of unexpected prompts.
What happened?
Researchers have reported a new Android malware campaign called Hirudo. The malware replaces legitimate banking apps with tampered versions that bypass security checks and steal user credentials. The campaign targets users in Indonesia and several other countries. No primary source has confirmed the findings yet.
What is Hirudo and how does it work?
Hirudo is a new Android malware campaign that targets banking app users by replacing their legitimate apps with modified, malicious versions. Instead of simply overlaying fake login screens, Hirudo uninstalls the real banking app and installs a nearly identical copy that has been tampered with to bypass the app's own security checks. This approach allows the malware to steal credentials and take control of the device without being detected by the app's built-in defences. The Hacker News (opens in a new tab) BleepingComputer (opens in a new tab) Security Affairs (opens in a new tab) SecurityWeek (opens in a new tab)
How does the attack unfold?
The attack begins when a user installs a seemingly legitimate app, such as a shopping or video app, which is actually a dropper for the Hirudo malware. These apps are distributed through fake websites that mimic the Google Play Store and are promoted via ads on social media. Once installed, the dropper app checks if the target banking app is present and if Hirudo is not already installed. It then displays a fake update prompt, launches the uninstaller for the real banking app, and downloads the malicious replacement. The user must grant permissions for the new app to function, including accessibility and notification access.
The replacement app retains most of the original code but adds a hooking engine that manipulates how the app responds to security checks. For example, it can return the correct signing certificate, hide the presence of malicious accessibility services, and disable screenshot protection. Play Integrity checks, which are meant to verify the app's authenticity, are relayed through an attacker-controlled server, making them unreliable.
Who is affected and what is at risk?
ThreatFabric researchers have identified eight Indonesian banking apps that have been specifically targeted with patched replacements. The malware's credential-stealing features also target users in China, India, Mexico, Morocco, and Thailand. Once installed, Hirudo can steal banking passwords, payment PINs, device unlock codes, and SMS messages. It can also stream the device's screen and camera to attackers, giving them full control over the device. The backend infrastructure used by the attackers was found to contain thousands of stolen credentials and financial profiles, though the total number of victims is not yet known.
What can banks and users do?
For banks, the main lesson is that local security checks within the app can no longer be trusted if the app itself has been replaced. Security researchers recommend that banks verify app integrity and attestation server-side, rather than relying on signals from the device alone. Behavioural analytics and transaction-risk controls should be layered in to spot suspicious activity.
For users, the best defence is to avoid installing apps from unofficial sources or links in ads, keep devices updated, and use Google Play Protect. If you see an unexpected update prompt for a banking app, be cautious and check with your bank directly.
What makes this attack different?
Hirudo marks a shift in Android banking malware tactics. By moving tampering inside the app itself, attackers can bypass many of the protections banks have put in place. This makes it harder for both users and banks to detect fraud. The campaign also shows a high level of technical skill, using open-source frameworks to patch apps and manage large-scale credential theft.
What happens next?
The campaign is still under investigation, and the full scale of the impact is not yet clear. No primary source has confirmed the findings, so further verification from Google or affected banks is needed. In the meantime, financial institutions and users in the targeted regions should be on high alert for suspicious app behaviour and credential theft.
Claimed vs confirmed
- Confirmed
Hirudo replaces legitimate banking apps with tampered versions to bypass security checks and steal credentials.
Reported by ThreatFabric and cited by multiple security news outlets.
- Unconfirmed
Thousands of credentials and financial profiles have been stolen.
Researchers found thousands of records in the attackers' backend, but the total number of victims is not confirmed.
The impact
- Money
- If banks are found negligent, regulators could impose fines. Under GDPR, fines can reach up to €20 million or 4% of annual turnover. The true financial impact is not yet known.
- Reputation
- Banks whose apps are targeted may face loss of trust, especially if users lose money due to the malware. The campaign's technical sophistication could also damage confidence in mobile banking security.
- Customers
- Users risk having their banking credentials, PINs, and personal information stolen. They should avoid installing apps from unofficial sources and be alert to unexpected update prompts.
Why it matters
This attack targets ordinary users of banking apps, putting their money and personal information at risk. It also challenges banks' security measures, as the malware can bypass app-level protections. Both users and financial institutions need to adapt their defences.
How does it work?
Hirudo is delivered through fake apps that act as droppers. Once installed, the malware uninstalls the real banking app and installs a modified copy. This copy uses a hooking engine to bypass security checks, hide malicious activity, and relay integrity checks through attacker-controlled servers. The malware then steals credentials and can remotely control the device.
Key points
- Hirudo replaces real banking apps with tampered copies to steal credentials.
- The malware bypasses app security checks by patching the app itself.
- It targets users in Indonesia and several other countries.
- Banks should not trust device-side integrity checks alone.
- Users should avoid installing apps from unofficial sources.
Sources
The Hacker News
Reference
BleepingComputer
Reference
Security Affairs
Reference
SecurityWeek
Reference
