Hirudo Android Trojan Replaces Banking Apps to Steal Credentials

• •Hirudo replaces legitimate banking apps with modified versions to evade security checks.
• •The malware targets multiple countries, including Indonesia, China, and India.
• •It is delivered via legitimate-looking apps that prompt fake updates to install the trojan.

Cybersecurity researchers have identified a new Android banking trojan named Hirudo that replaces legitimate banking apps with modified versions to bypass security checks. ThreatFabric reported that Hirudo targets eight Indonesian banking apps and also affects financial institutions in China, India, Mexico, Morocco, and Thailand. The malware is delivered through seemingly legitimate apps for shopping and entertainment, which prompt users to install the trojan under the guise of an in-app update. Once installed, Hirudo can steal banking credentials, remotely control devices, capture screenshots, and record audio. The malware employs a hooking engine to disable security features within the banking apps, making it a significant threat to users' financial data. The current scope of impact is unclear, but thousands of credential entries have been found in an unsecured backend panel. Researchers emphasize that Hirudo represents a notable escalation in Android banking malware tactics.