Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.

Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.

“The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend,” Eward Driehuis, vice president of fraud engineering at ThreatFabric, said in a statement shared with The Hacker News.

Hirudo facilitates on-device credential theft and live remote control. The malware is delivered by shopping, adult video, and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.

Some of the dropper apps are listed below –

• Shopora (com.agbbh.kjdrttt)
• 1V1 X (com.onev.vip)
• KoiShort (com.koishort.app)
• ZoyaTV (com.zoyatv.app)

“The lure is functional, loading real content in a WebView, a storefront, a video catalogue or short dramas, so the experience looks legitimate,” ThreatFabric explained. “Behind that content the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches its campaign configuration, and checks whether the payload, the Hirudo RAT, is already installed with its accessibility service and notification access enabled.”

If it’s not present, it displays a fake in-app update prompt to trigger the installation of the malware. It’s worth emphasizing that Hirudo is installed as a second app and must be granted its own permissions before it can carry out the malicious activities.

As observed in the case of StreamRat, the malware implements an anti-detection technique based on blocking Internet access by configuring a deliberately non-functional VPN connection prior to the payload installation. This is seen as an attempt to prevent other apps and services, like Google Play Protect, from carrying out cloud-based checks of the payload.

“However, Play Protect also provides offline detection for known potentially harmful applications, meaning that the mechanism does not completely disable its protection,” ThreatFabric noted last month. “We therefore assess that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms rather than bypass Play Protect entirely.”

Depending on the nature of the lure app used, the dropper is also designed to serve bogus screens to capture payment PINs, serve fake screens requesting login credentials for banks and wallet apps, display fake lock screen pattern and PIN overlays, and facilitate total remote control of the device.

While all this behavior is par for the course when it comes to Android banking trojans, it’s their attempts to replace the target banking app with a tampered copy that stand out. Specifically, the purpose-built replacements embed a hooking engine to blind signature, accessibility, screen-capture, and Play Integrity checks from within the app. The replacement targets eight Indonesian apps.

“For these, the RAT detects the installed banking app through accessibility, checks its signing certificate against a stored reference, [and] then shows a fake ‘update’ prompt,” ThreatFabric explained. “It opens Android’s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.”

While the need for having to remove the app before installing its near-identical malicious copy is a “real constraint,” the mechanism offers the ability to bypass the banking app’s own security checks by returning responses fed by the attacker beforehand.

This involves returning the genuine app signing certificate, returning an empty list when querying for enabled accessibility services, and stripping the FLAG_SECURE flag so that the app’s screens can be viewed and recorded remotely.

“Key-attestation certificates are re-signed with a bundled keybox, and Play Integrity requests are relayed over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept,” the mobile security company said.

“Two details are worth underlining for defenders. First, the attestation keybox the engine ships is not the operators’ own: it is a publicly leaked keybox. Second, because the Integrity request is relayed rather than genuinely produced, a valid Integrity response alone is not evidence of an untampered app.”

Evidence indicates that the malware is distributed via fake web pages masquerading as Google Play Store landing pages for shopping, short drama, and football apps. Unsuspecting users are assessed to be directed to these websites through ads on Meta-owned social media platforms.

The entire operation rests on a backend that combines device control with the ability to manage different campaigns and stolen data, including device records, lock-screen history, and financial profiles containing monthly income and risk-score fields.

“Hirudo marks a deliberate escalation in how Android bankers approach hardened applications,” ThreatFabric said. “By moving its tampering inside the target app, the operation shifts the contest from the device to the application’s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.”

“Once an app can be replaced, its locally produced signals, signature, accessibility list, and integrity verdict, must be treated as attacker-influenced and verified server-side,” ThreatFabric said.

Last month, the findings came a little over a month after the cybersecurity firm revealed StreamRat’s targeting of Spanish-speaking users via Meta and TikTok advertisements impersonating a free TV streaming service named Streamtv Esp to enable control over compromised Android devices.

“StreamRat abuses accessibility services and MediaProjection to provide operators with near-complete control over infected devices, combining VNC and hidden-screen control, UI-tree collection, keylogging, credential-stealing overlays, internet and screen-blocking capabilities,” ThreatFabric said.