Most Android banking malware works by drawing a fake login box over the real app and hoping you type into it. Banks have got reasonably good at spotting that. The Hirudo trojan, described on 14 October by ThreatFabric, takes the opposite approach: it removes the real app and puts a doctored copy in its place.
How the swap works
The entry point is an ordinary-looking app. ThreatFabric names a shopping app called Shopora, an adult video app called 1V1 X and two short-drama apps, ZoyaTV and KoiShort, all of which do what they promise. A fake update prompt then walks the victim through permission requests, including Accessibility access. After that Hirudo launches the uninstaller for the genuine banking app, downloads a patched build and uses Accessibility to install it. ThreatFabric notes the victim gets two chances to cancel, which says something about how much of this depends on a person tapping through.
The patched app keeps almost all of the original code. What it adds is a hooking layer built on the open-source YAHFA and Dobby projects, and that layer lies on the bank's behalf. It returns the real signing certificate when the app asks who signed it, hides enabled Accessibility services, strips screenshot protection and tampers with key attestation, relaying Play Integrity requests through a server the operators control. With those checks neutered, the operators get live screen streaming, camera access, SMS and message collection, audio recording and remote control, plus fake checkout pages that harvest payment PINs and then show a made-up success message.
Where it is aimed, and where it is weak
Right now the replacement apps cover eight Indonesian banking apps from at least seven banks, though credential targeting reaches China, India, Mexico, Morocco and Thailand. The victim count is unknown. Two details are encouraging. The attestation keybox bundled with the malware has been leaked publicly and Google lists two of its certificates as compromised, so a server that checks revocation can catch the forgery. And the operators left their APK-processing panel unauthenticated, exposing thousands of credential entries and cloud storage details, which is how the researchers mapped the operation so well.
What it means if you build or run a mobile app
- Treat on-device checks as hints. Anything the client reports about its own certificate or integrity can be forged by a hooked client, so validate attestation on your server.
- Bind those verdicts to the session and to risky actions such as adding a payee or changing a limit, rather than checking once at login.
- Check revocation status of attestation certificates, since that is exactly where this sample is vulnerable.
- Keep behavioural and transaction-risk scoring running. A device that passes every check yet streams its screen and taps like a script still looks odd.
- For staff phones that reach corporate apps, restrict sideloading and watch for Accessibility services granted to anything that is not an assistive tool.
For customers the advice has not changed much: install from official stores, be wary of any app that asks for Accessibility access, and run Play Protect scans. For a review of mobile app attestation and fraud signals, contact sales@halfteck.com.