{"id":3535,"date":"2026-10-14T16:08:52","date_gmt":"2026-10-14T16:08:52","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3535"},"modified":"2026-10-14T16:08:52","modified_gmt":"2026-10-14T16:08:52","slug":"hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3535","title":{"rendered":"Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj010OXrg2ZBrxwqSnpzd8SrIDY_dYOMtdnzIpG7YnCjv1QB58_HylDTkfFmXtZYci90doRcSrPdFfYLowM_S5t2RpD6UkCoWveJrKajQS-7d3sDtyI22FYN0TKy-pQpzWScUB_ROhXRNzZi9dzhgg02kH3WVtdGPNWYBLKv8qZgsa9kREW1SvZ2LTF2AWV\/s1700-nu-rw-lo-l85-e365\/android-banking.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Cybersecurity researchers have disclosed details of a new Android banking trojan called <strong>Hirudo<\/strong> that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. <\/p>\n<p>Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.<\/p>\n<p>\u00abThe operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend,\u00bb Eward Driehuis, vice president of fraud engineering at ThreatFabric, <a href=\"https:\/\/www.threatfabric.com\/blogs\/hirudo-from-fake-updates-to-patched-banking-apps\" target=\"_blank\">said<\/a> in a statement shared with The Hacker News.<\/p>\n<p>Hirudo facilitates on-device credential theft and live remote control. The malware is delivered by shopping, adult video, and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.<\/p>\n<p>Some of the dropper apps are listed below &#8211;<\/p>\n<ul>\n<li>Shopora (com.agbbh.kjdrttt)<\/li>\n<li>1V1 X (com.onev.vip)<\/li>\n<li>KoiShort (com.koishort.app)<\/li>\n<li>ZoyaTV (com.zoyatv.app)<\/li>\n<\/ul>\n<p>\u00abThe lure is functional, loading real content in a WebView, a storefront, a video catalogue or short dramas, so the experience looks legitimate,\u00bb ThreatFabric explained. \u00abBehind that content the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches its campaign configuration, and checks whether the payload, the Hirudo RAT, is already installed with its accessibility service and notification access enabled.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/growth-ai-control-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVYuoalvwUlwvLZFDideJ8jW4rz-IodX0Lwi7uyP7Ab0wiDeu_BqVhPDdejQQ65MC3p9Xc4MApnHz56NJ5SDc1HMg0DvozkkGYv9TGtDLCh26v1yD5-GyzQxnA5-6A6B4beW96H_6FyrByq22cvU5JDF-i8e5GIfV4wg1SpCvjwAJt74FaqkAb2gzqE7ll\/s728-nu-rw-lo-l85-e365\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>If it&#8217;s not present, it displays a fake in-app update prompt to trigger the installation of the malware. It&#8217;s worth emphasizing that Hirudo is installed as a second app and must be granted its own permissions before it can carry out the malicious activities.<\/p>\n<p>As observed in the case of <a href=\"https:\/\/thehackernews.com\/2026\/09\/meta-ads-push-streamrat-android-trojan.html\" target=\"_blank\">StreamRat, the malware implements an anti-detection technique based on blocking Internet access by configuring a deliberately non-functional VPN connection prior to the payload installation. This is seen as an attempt to prevent other apps and services, like Google Play Protect, from carrying out cloud-based checks of the payload.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgbdYja-91DB_iOWcCA5eksVFfGuM034qTpOe336soH_rW6opGFqwhyphenhyphenLPMZ2hdWyKWAaa5P3K90jaeCf63_WuDZ3aanIjX7O4CQmxHCLM-lQC1tFGovrZjwGSBcz4dy7zjuILCIbcVzf7EaTb9Yvgr9kFJnjX_qktwWKlomn5DR_c3B88UUT9E7v4P3w7Ab\/s1700-nu-rw-lo-l85-e365\/1.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgbdYja-91DB_iOWcCA5eksVFfGuM034qTpOe336soH_rW6opGFqwhyphenhyphenLPMZ2hdWyKWAaa5P3K90jaeCf63_WuDZ3aanIjX7O4CQmxHCLM-lQC1tFGovrZjwGSBcz4dy7zjuILCIbcVzf7EaTb9Yvgr9kFJnjX_qktwWKlomn5DR_c3B88UUT9E7v4P3w7Ab\/s1700-nu-rw-lo-l85-e365\/1.png\" alt=\"\" border=\"0\" data-original-height=\"1667\" data-original-width=\"3333\"\/><\/a><\/div>\n<p>\u00abHowever, Play Protect also provides offline detection for known potentially harmful applications, meaning that the mechanism does not completely disable its protection,\u00bb ThreatFabric noted last month. \u00abWe therefore assess that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms rather than bypass Play Protect entirely.\u00bb<\/p>\n<p>Depending on the nature of the lure app used, the dropper is also designed to serve bogus screens to capture payment PINs, serve fake screens requesting login credentials for banks and wallet apps, display fake lock screen pattern and PIN overlays, and facilitate total remote control of the device.<\/p>\n<p>While all this behavior is par for the course when it comes to Android banking trojans, it&#8217;s their attempts to replace the target banking app with a tampered copy that stand out. Specifically, the purpose-built replacements embed a hooking engine to blind signature, accessibility, screen-capture, and Play Integrity checks from within the app. The replacement targets eight Indonesian apps.<\/p>\n<p>\u00abFor these, the RAT detects the installed banking app through accessibility, checks its signing certificate against a stored reference, [and] then shows a fake &#8216;update&#8217; prompt,\u00bb ThreatFabric explained. \u00abIt opens Android&#8217;s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.\u00bb<\/p>\n<p>While the need for having to remove the app before installing its near-identical malicious copy is a \u00abreal constraint,\u00bb the mechanism offers the ability to bypass the banking app&#8217;s own security checks by returning responses fed by the attacker beforehand.<\/p>\n<p>This involves returning the genuine app signing certificate, returning an empty list when querying for enabled accessibility services, and stripping the FLAG_SECURE flag so that the app&#8217;s screens can be viewed and recorded remotely.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjpx6oglh2QPl9YWWjVZeANIArF-2mcjt5SoOZy1lVOY4Sa_yJLeRKvmH2O4qUmWRJOOzy6Viqy6hfTGJiosI_HHAtGARLDI96Z4xi8sy2QV_scqNwbZuItdaC86U5Zr3w4_CQpHJSHVRt3Iw5cdF1yMgsxdGb6ndg4vClzCu3ie38j5LxnR_dCGFt2-Hil\/s1700-nu-rw-lo-l85-e365\/2.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjpx6oglh2QPl9YWWjVZeANIArF-2mcjt5SoOZy1lVOY4Sa_yJLeRKvmH2O4qUmWRJOOzy6Viqy6hfTGJiosI_HHAtGARLDI96Z4xi8sy2QV_scqNwbZuItdaC86U5Zr3w4_CQpHJSHVRt3Iw5cdF1yMgsxdGb6ndg4vClzCu3ie38j5LxnR_dCGFt2-Hil\/s1700-nu-rw-lo-l85-e365\/2.png\" alt=\"\" border=\"0\" data-original-height=\"1935\" data-original-width=\"3456\"\/><\/a><\/div>\n<p>\u00abKey-attestation certificates are re-signed with a bundled keybox, and Play Integrity requests are relayed over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept,\u00bb the mobile security company said.<\/p>\n<p>\u00abTwo details are worth underlining for defenders. First, the attestation keybox the engine ships is not the operators&#8217; own: it is a publicly leaked keybox. Second, because the Integrity request is relayed rather than genuinely produced, a valid Integrity response alone is not evidence of an untampered app.\u00bb<\/p>\n<p>Evidence indicates that the malware is distributed via fake web pages masquerading as Google Play Store landing pages for shopping, short drama, and football apps. Unsuspecting users are assessed to be directed to these websites through ads on Meta-owned social media platforms.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The entire operation rests on a backend that combines device control with the ability to manage different campaigns and stolen data, including device records, lock-screen history, and financial profiles containing monthly income and risk-score fields.<\/p>\n<p>\u00abHirudo marks a deliberate escalation in how Android bankers approach hardened applications,\u00bb ThreatFabric said. \u00abBy moving its tampering inside the target app, the operation shifts the contest from the device to the application&#8217;s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.\u00bb<\/p>\n<p>\u00abOnce an app can be replaced, its locally produced signals, signature, accessibility list, and integrity verdict, must be treated as attacker-influenced and verified server-side,\u00bb ThreatFabric said.<\/p>\n<p>Last month, the findings came a little over a month after the cybersecurity firm revealed StreamRat&#8217;s targeting of Spanish-speaking users via Meta and TikTok advertisements impersonating a free TV streaming service named Streamtv Esp to enable control over compromised Android devices.<\/p>\n<p>\u00abStreamRat abuses accessibility services and MediaProjection to provide operators with near-complete control over infected devices, combining VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, internet and screen-blocking capabilities,\u00bb ThreatFabric said.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3536,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[281,616,615,3126,394,931,3781,1707,47,667],"class_list":["post-3535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-android","tag-apps","tag-banking","tag-builtin","tag-bypass","tag-checks","tag-hirudo","tag-patched","tag-security","tag-trojan"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3535"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3536"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}