Hirudo Android Malware Overrides Banking Apps to Bypass Security Checks
A newly identified Android malware strain named Hirudo compromises financial applications by substituting authentic banking apps with modified versions designed to circumvent security validations.
Overview of Hirudo Malware
Security analysts discovered malicious iterations of eight banking applications that employ a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks through certificate manipulation or empty list generation.
Cybercriminals utilizing Hirudo can extract login credentials, execute real-time remote control of infected devices, harvest messages, capture visual and audio data, and intercept communications.
A recent analysis by mobile security firm ThreatFabric indicates that Hirudo has impersonated at least seven Indonesian financial institutions, with additional targets spanning China, India, Mexico, Morocco, and Thailand.
Spread Through Malicious Applications
The malware typically spreads through applications offering shopping (Shopora), adult content (1V1 X), or short-form drama (ZoyaTV, KoiShort) services, which appear legitimate but function as malware delivery vectors.
These apps trigger deceptive update notifications that prompt users to grant Accessibility service permissions, initiating the infection process.
Attack Sequence and Evasion Tactics
The attack sequence involves Hirudo launching the genuine banking app’s uninstaller, a high-risk maneuver requiring precise execution to avoid user interruption.
Researchers note that the malicious variant retains most of the original app’s codebase but integrates a hooking engine built on open-source frameworks YAHFA and Dobby.
- Replacing authentic digital certificates during verification requests
- Concealing active Accessibility services
- Disabling screenshot protection to enable remote monitoring
- Altering attestation certificates and redirecting Play Integrity checks through a controlled server
By embedding the hooking engine within the banking app’s process, the malware exploits the application’s own security mechanisms against itself.
However, ThreatFabric highlights limitations in these evasion strategies, including the public exposure of the bundled attestation keybox and Google’s identification of two compromised certificates, allowing server-side revocation detection.
Data Extraction and Impact
Once operational, Hirudo extracts banking credentials, payment PINs, device unlock codes, and SMS data, streams device screens to operators, and accesses camera functions.
The malware’s counterfeit checkout interfaces capture PINs before displaying fabricated transaction confirmations to mislead users.
Data extraction processes reveal thousands of credential entries in an unsecured backend portal, alongside device, lock-screen, and financial profile information.
The exact number of affected users remains undisclosed.
Conclusion and Recommendations
ThreatFabric emphasizes that Hirudo represents a strategic shift in Android banking malware, focusing on application-level security measures rather than device-wide integrity checks.
The report advises financial institutions to implement server-side integrity validations, tie checks to session-specific actions, and maintain behavioral and transaction-risk monitoring systems.
Security experts urge Android users to adopt robust protective measures against evolving threats.
About Author
English