Hirudo Android RAT Replaces Banking Apps With Trojanized Clones to Bypass Security

ThreatFabric researchers have identified a novel Android remote access trojan named Hirudo that actively replaces legitimate banking applications with malicious clones. According to SecurityWeek, the malware combines traditional banking theft techniques with full remote control capabilities. This approach allows attackers to bypass security controls by modifying the target application itself rather than relying on device-level exploits.

The malware currently targets eight specific banking applications in Indonesia. Internal code analysis suggests the threat actors could easily expand operations to banks in China, India, Mexico, Morocco, and Thailand. The operation involves detecting the installed banking app, displaying a fake update prompt, and then uninstalling the genuine software. The dropper then installs a modified, bank-specific replacement that contains the malicious payload.

Technical Evasion and Capabilities

Hirudo employs a sophisticated hooking engine to neutralize security checks from within the replaced application. When the app queries Android for its signing certificate, the hook substitutes the genuine certificate to hide the test-key signature. It also returns an empty list when the app checks for enabled Accessibility services, making the controlling service invisible to the user and the system.

The malware provides attackers with live remote control of the victim device through WebRTC screen viewing. It grants access to both front and rear cameras and allows interaction via Android Accessibility Services. Additionally, the trojan collects SMS messages, including a 90-day initial scan and a configured list of bank and wallet senders to steal credentials and transaction codes.

Distribution and Impact

Victims typically encounter the malware through social media advertisements for legitimate-looking content. The dropper is embedded within fake shopping applications, adult video apps, or short drama apps. Once the user installs what appears to be a harmless application, the dropper checks if the Hirudo RAT is already present on the device. If the malware is not detected, the dropper proceeds to install the remote access trojan.

This technique represents a deliberate escalation in how attackers approach hardened Android applications. By moving tampering inside the target app, the operation shifts the security contest from the device to the application’s own integrity checks. Researchers note that this allows for a reusable engine that can be retargeted at other apps and regions without creating bespoke patches for each target.

That suggests local signals produced by an app which may have been replaced cannot be trusted on their own for security verification. As Threat Times reported on 2026-10-14, the Hirudo Trojan bypasses banking app defenses by injecting hooks into legitimate code to steal credentials across six countries.

What should you do?

Security professionals should monitor for unauthorized application replacements and unexpected permission requests on Android devices. Organizations should ensure that banking applications are downloaded only from official app stores and verify application signatures regularly. Users should remain cautious of social media advertisements offering free apps, particularly those unrelated to their primary device usage.

What to do and how to stay safe: Hirudo

• Verify application integrity by checking digital signatures against known good hashes from official sources.
• Monitor device logs for unexpected uninstallations of banking apps followed by immediate re-installations.
• Review installed applications for unknown Accessibility services that may indicate remote control access.
• Avoid downloading applications from links found in social media advertisements or unverified third-party sites.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does Hirudo bypass Android security checks?

It replaces the legitimate banking app with a trojanized version that uses a hooking engine to blind signature, Accessibility, and Play Integrity checks from within the app.

Which countries are currently targeted by this malware?

The malware currently targets eight banking apps in Indonesia, though code suggests potential expansion to China, India, Mexico, Morocco, and Thailand.

How is the malware distributed to victims?

It is delivered via droppers contained in fake shopping, adult video, or short drama apps that are advertised on social media platforms.