Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Hirudo is a new Android banking trojan that replaces legitimate banking apps with tampered versions to bypass built-in security checks. The malware is distributed via dropper apps disguised as shopping, adult video, and entertainment apps, which prompt fake in-app updates to install the payload. It enables on-device credential theft, remote control, screen and camera capture, and SMS theft by leveraging accessibility services and bypassing Play Protect using a non-functional VPN. The trojan specifically targets eight Indonesian banking apps but also has credential harvesting capabilities for users in China, India, Mexico, Morocco, and Thailand.

AI-extracted · verify before operational use