Hirudo Trojan Bypasses Banking App Defenses by Injecting Hooks Into Legitimate Code
ThreatFabric reveals how the Hirudo Android trojan replaces banking apps with patched clones to steal credentials across six countries.
Key points
- Hirudo malware injects hooking engines into banking apps to bypass signature and integrity checks.
- The trojan targets financial institutions in Indonesia, China, India, Mexico, Morocco, and Thailand.
- Delivery occurs via fake shopping and entertainment apps that prompt users to install the malware.
ThreatFabric researchers disclosed details of the Hirudo Android trojan, which steals banking credentials by replacing legitimate applications with modified versions that bypass internal security checks. The Dutch mobile security firm identified this technique as a significant escalation in financial fraud targeting Android users.
The malware replaces eight identified Indonesian banking applications with patched clones designed to evade app-signature verification, Accessibility service restrictions, and Google Play Integrity checks. According to ThreatFabric, this approach allows attackers to maintain control over the banking process while disabling built-in protections.
Technical Operation and Evasion
Hirudo is delivered through seemingly legitimate dropper applications, including shopping platforms like Shopora and entertainment apps such as ZoyaTV and KoiShort. These loaders present functional content within a WebView to appear authentic while preparing the device for malware installation in the background.
The dropper checks if the Hirudo remote access tool is already active. If not, it displays a fake update prompt that tricks users into granting Accessibility and notification permissions. Once these permissions are granted, the malware installs as a separate application on the device.
ThreatFabric noted that Hirudo uses a hooking engine built on open-source frameworks YAHFA and Dobby. This engine runs inside the banking app’s process, allowing it to substitute genuine signing certificates and return empty lists for security queries. This effectively neutralizes the app’s own defenses against manipulation.
Scope and Capabilities
The operation targets financial organizations across six countries: Indonesia, China, India, Mexico, Morocco, and Thailand. While eight Indonesian banks have specific cloned apps identified, the credential theft infrastructure supports multiple regions, indicating a broad campaign scope.
Once active, Hirudo provides operators with real-time remote control of infected devices. Capabilities include stealing banking passwords, payment PINs, and SMS messages. Attackers can also capture screenshots, record audio, and access both front and rear cameras for live surveillance.
ThreatFabric reported that the malware employs an anti-detection technique by establishing a non-functional VPN connection before payload installation. This blocks internet access to prevent cloud-based analysis by tools like Google Play Protect, though offline detection mechanisms may still identify the threat.
What should you do?
Users should monitor device permissions closely, particularly requests for Accessibility services or notification access from unrelated applications. Avoid installing apps from outside official stores, as these droppers often masquerade as popular shopping or entertainment tools.
ThreatFabric found that some of the attestation keys used by Hirudo have been leaked and listed as compromised by Google. Server-side revocation checks can detect these forgeries, meaning users should keep their devices updated to receive the latest security patches and integrity checks.
No specific fix has been confirmed by the affected banking vendors yet. Security professionals should monitor threat intelligence feeds for new indicators of compromise related to the Shopora, 1V1 X, and ZoyaTV dropper applications.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Hirudo
- Review installed applications and remove any unfamiliar apps that request Accessibility or notification permissions.
- Enable Google Play Protect and ensure it is set to scan apps regularly for known threats.
- Avoid clicking on in-app update prompts within entertainment or shopping apps that lead to external installation packages.
- Monitor bank statements for unauthorized transactions and change passwords if suspicious activity is detected.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Hirudo bypass banking app security checks?
It replaces the legitimate app with a patched version that uses hooking engines to substitute certificate information and disable integrity checks.
Which countries are targeted by the Hirudo trojan?
The malware targets users in Indonesia, China, India, Mexico, Morocco, and Thailand.
What apps are used to deliver the Hirudo malware?
It is delivered via dropper apps like Shopora, 1V1 X, ZoyaTV, and KoiShort that mimic legitimate shopping and entertainment services.
