Hirudo Android malware replaces banking apps to evade security checks

Hirudo is a new Android malware that targets banking applications by replacing legitimate apps with malicious, modified versions to bypass security checks such as app-signature verification, Accessibility service detection, and Google Play Integrity. The malware is distributed through seemingly legitimate third-party apps for shopping, adult content, and short dramas, which act as loaders and prompt users to grant Accessibility permissions. Once installed, Hirudo can steal banking credentials, payment PINs, SMS messages, and device unlock secrets, while also enabling real-time remote control, screen streaming, audio recording, and camera access. The malware has primarily targeted banks in Indonesia but also affects financial institutions in China, India, Mexico, Morocco, and Thailand.

AI-extracted · verify before operational use