Threat intel

Hirudo swaps your banking app for a hooked copy

By Yaali. October 16, 2026, 6 min read, Threat intel, Identity.

Android trojan Hirudo uninstalls Indonesian bank apps and installs patched copies that blind their own security checks. How it works and what to do.

ThreatFabric published research on October 14 into Hirudo, an Android banking trojan with remote access features. Most banking malware draws a fake login screen over the real app. Hirudo removes the victim's genuine banking app and installs a modified copy that still works as the bank's app, with a hooking engine inside it that feeds false answers to the app's own security checks. ThreatFabric found replacement builds for eight Indonesian banking apps belonging to seven banks; BleepingComputer phrases it as at least seven banks. Credential-stealing code also targets financial apps used in China, India, Mexico, Morocco and Thailand, though no patched replacements for those have been reported.

This matters to any bank or fintech whose mobile app decides on the device whether the device is safe. Signature checks, Accessibility checks, screenshot blocking and Play Integrity all run inside the app, and Hirudo controls the app. The number of victims is unknown, and none of the reports says whether the affected banks have changed their apps or backends since the disclosure.

How it works

Infection starts with a dropper, an app whose real job is to install another app. Hirudo's droppers pose as shopping, adult video and short-drama apps promoted on social media, and the ones named in the reports are Shopora, 1V1 X, ZoyaTV and KoiShort. They load real content in a WebView (an embedded browser) so they behave like the app the victim wanted. They then show a fake in-app update prompt. The "update" is Hirudo itself, a separate app that must be granted Accessibility and notification access on its own. ThreatFabric also found that one dropper sets up a deliberately broken VPN during install to cut internet access, which it assesses is meant to weaken Google Play Protect's online reputation checks; offline detection still works.

Once it has Accessibility access, Hirudo looks for a supported banking app and compares that app's signing certificate with a stored reference. It then shows a fake update prompt, opens Android's uninstaller for the genuine app and downloads the bank-specific replacement in parallel. The replacement keeps the original package name, but it is signed with a public test key. Android refuses to install an app over an existing one signed with a different key, so the genuine app has to be removed first. ThreatFabric points out that this gives the victim two chances to interrupt the swap.

The patched app keeps almost all of the bank's code. What the attackers add is a hooking engine built on two open-source frameworks: YAHFA, which hooks Java methods, and Dobby, which hooks native functions. A hook intercepts a function call and returns whatever the attacker chooses. Because the engine runs in the banking app's own process, every check the app makes about itself goes through it:

When the app asks for its signing certificate, the hook returns the genuine bank certificate instead of the test key.
When the app asks which Accessibility services are enabled, the hook returns an empty list, hiding Hirudo's controlling service.
FLAG_SECURE, the window flag that stops screenshots and screen recording, is stripped, so the operator can watch and record banking screens.
Play Integrity requests are relayed over plain HTTP to an operator server, which returns a verdict the app accepts. Key attestation certificates are re-signed with a bundled keybox (a device attestation key and certificate chain) that was leaked publicly and is not the operators' own.

That last point is also Hirudo's weak spot. BleepingComputer and Security Affairs both report that Google lists at least two of the keybox's certificates as revoked, so a server that checks attestation chains against Google's revocation list can catch the forgery.

What attackers are doing

With the patched app in place, Hirudo steals banking passwords, payment PINs and SMS messages, and shows fake PIN entry and login screens for banks and wallets. Fake checkout pages collect a payment PIN and then show a payment success screen. It also shows fake lock screen pattern and PIN prompts to capture the unlock secret. Through Accessibility it gives the operator live remote control, with screen streaming and sessions on both the front and rear cameras.

The operators' backend panel was reachable without authentication. ThreatFabric found thousands of stolen application credential entries in it, alongside device records, lock screen history and financial profiles with fields such as monthly income and risk score. SecurityWeek quotes ThreatFabric calling Hirudo a deliberate escalation: the engine is reusable and can be pointed at other apps and regions.

What to do

Banks and app owners

ThreatFabric's conclusion is that once an app can be replaced, the signals it produces locally "must be treated as attacker-influenced and verified server-side." In practice:

Decode and verify Play Integrity tokens on your backend, never in the app. Check that requestHash (or nonce for classic requests) matches the value your server issued for this action, that appRecognitionVerdict is PLAY_RECOGNIZED, and that certificateSha256Digest matches your release certificate. A patched app signed with a test key cannot produce a Google-signed token that passes these checks, which is why Hirudo relays the request to its own server. Your server should reject any session that sends no token, or a token it cannot decode.
Validate key attestation chains on the server and check every certificate against Google's attestation revocation list. The leaked keybox Hirudo uses is on it.
Read environmentDetails.appAccessRiskVerdict from the same token. UNKNOWN_CONTROLLING and UNKNOWN_CAPTURING mean an app not installed from Google Play holds permissions that could control the device or view the screen.
Treat Accessibility and screen capture results reported by the app as risk inputs, not proof. SecurityWeek reports ThreatFabric's advice that missing behavioural data can itself be suspicious.
Keep server-side transaction risk controls at login, credential recovery, new beneficiary creation and payment approval. A first login on a reinstalled app followed quickly by a new payee is a pattern worth stepping up.

Enterprises

On managed Android devices, set the mobile device management (MDM) policy that blocks installs from unknown sources, which stops both the dropper's payload and the patched bank app. Use Android Enterprise's permitted Accessibility services list so only named assistive apps can hold that permission.

Users

Do not install apps from links in social media posts or ads, keep Play Protect turned on, and run a scan from the Play Store app (profile icon, then Play Protect). A banking app should only ever update through Google Play. A prompt to "update" it from inside another app is an attack, and so is an app that suddenly asks for Accessibility access.

If you think a phone is infected, switch on airplane mode to cut the operator's live connection, then call your bank from a different phone and ask them to freeze online banking and cards. Factory reset the phone, reinstall the banking app from Google Play only, and change banking passwords, PINs and the screen lock from a clean device.

Device checks belong on the server

Each check Hirudo defeats runs on a phone the attacker controls and reports to code the attacker has hooked. A result the app sends about its own integrity should be weighed on the bank's server alongside signals the phone cannot forge: a Google-signed verdict bound to this request, the revocation status of the attestation chain, and how the session behaves at login and payment time.

Our mobile penetration testing team tests whether a banking app's backend still makes the right call when the app is repackaged, hooked and lying about itself, and our mobile app development engineers build server-side attestation into apps from the start. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: The Hacker News, BleepingComputer, SecurityWeek, Security Affairs, Android Developers, Play Integrity verdicts.