Hirudo Android trojan swaps banking apps for patched copies that skip security checks

Dutch mobile security firm ThreatFabric has disclosed a new Android banking trojan named Hirudo that replaces genuine banking apps on victims' phones with tampered copies designed to defeat the apps' own security checks, The Hacker News reported on October 14, 2026. According to the report, the operation pairs credential theft with full device takeover and screen, camera and SMS capture, and has produced patched versions of eight Indonesian banking apps.

What happened

The Hacker News reports that Hirudo spreads through dropper apps disguised as shopping, adult video and entertainment apps, which deliver the trojan as a separate package presented as an in-app update. Victims reach the droppers through fake Google Play landing pages for shopping, short-drama and football apps, reportedly promoted via ads on Meta platforms. Once launched, a dropper shows legitimate-looking content in a WebView and checks whether the remote access trojan is already installed with accessibility and notification access; if not, it displays a fake update prompt.

The report says the dropper configures a non-functional VPN before installing the payload, a trick also seen in StreamRat that may hinder cloud-based checks by Google Play Protect. Credential targeting covers users in Indonesia, China, India, Mexico, Morocco and Thailand.

Technical details

What sets Hirudo apart, according to ThreatFabric, is app replacement. Using accessibility services, the trojan detects a genuine banking app, checks its signing certificate, shows a fake update prompt, opens the uninstaller and then downloads a tampered replacement. The modified app contains a hooking engine that returns the genuine app's signing certificate, reports an empty list when asked which accessibility services are enabled, and removes the FLAG_SECURE protection so screens can be captured remotely.

Play Integrity requests are relayed over plain HTTP to an operator-controlled server that returns a verdict the app accepts, while key-attestation certificates are re-signed with a bundled keybox that ThreatFabric identified as publicly leaked. Other capabilities include fake PIN and bank or wallet login screens, fake lock-screen overlays, SMS theft and full remote control. The backend tracks device records, lock-screen history and financial profiles including monthly income and risk-score fields.

The Hacker News lists the following dropper package names: com.agbbh.kjdrttt (Shopora), com.onev.vip (1V1 X), com.koishort.app (KoiShort) and com.zoyatv.app (ZoyaTV).

What to do

ThreatFabric advises banks and app developers that once an app can be replaced, locally generated signals such as its signature, accessibility list and integrity verdict should be treated as attacker-influenced and verified on the server side. Security teams can search managed devices for the package names above and watch for unexpected secondary apps requesting accessibility access. Users should install apps only from official stores, be wary of ads leading to Play Store look-alike pages, refuse accessibility or notification access for unfamiliar apps, and treat update prompts that do not come from the official store as suspicious.