Hirudo, an Android banking trojan detailed by the mobile threat intelligence team at ThreatFabric, removes a genuine banking app from an infected phone and installs a doctored copy that carries the bank’s own code plus hooks that hide the tampering. The malware keeps a registry of 42 financial apps, but only eight Indonesian banking apps from seven banks have prepared replacements so far.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
ThreatFabric did not name individual analysts in its write-up, crediting the work to the firm’s team, and published it on October 14, 2026. No count of infected devices or stolen money has been reported.
How Hirudo replaces a banking app instead of overlaying it
Most Android banking trojans draw a fake login window on top of the real app. According to ThreatFabric’s technical report, Hirudo does that in places, including a fake checkout page that captures payment PINs, but its distinctive trick is repackaging. For the eight targeted Indonesian apps, it uninstalls the original and installs a patched build that keeps the package name and version but is signed with a public test key. Android refuses to install a differently signed app over a genuine one, so the original has to go first, and the victim can interrupt that step.
The patch itself is small. One added line in the app’s Application class loads a hooking engine built on YAHFA, a framework for replacing Java methods in Android’s runtime, and Dobby, a compact framework for hooking native functions. The engine stays dormant until the trojan’s remote access component creates a trigger file on the phone.
Underneath the swap sits a full remote access trojan. ThreatFabric describes Hirudo as combining credential theft with live remote control, screen and camera capture and SMS collection, and in one build it reads lock-screen input through Accessibility. That breadth matters because a replaced banking app is only the final step: the same foothold lets an operator watch a session as it happens, read text-message codes and drive the phone while the owner looks at an ordinary-seeming banking screen.
Spoofed security checks and Play Integrity relays
Once active, the hooks lie to the bank’s own defenses. They return the genuine signing certificate in place of the test key, report an empty list of enabled accessibility services so the controlling service stays hidden, and remove the flag that blocks screenshots, which lets an operator watch and record the banking screen remotely.
The Play Integrity check, which Google designs to confirm that a request comes from an unmodified app on a genuine device, is relayed over plain HTTP to an operator-controlled server that returns an acceptable verdict. ThreatFabric said the attestation keybox behind this is publicly leaked and that at least two of its certificates appear on Google’s revocation list. Its defensive conclusion was that signals produced locally by an app that may have been replaced cannot be trusted on their own, so banks should verify them on the server side.
The payload needs its own Accessibility and notification permissions before any of this works. When it detects a target bank, it checks the installed app’s signing certificate, shows a fake update prompt and opens Android’s uninstaller without waiting for a tap, while downloading the replacement in parallel.
Droppers, lures and what is known about distribution scale
Hirudo reaches phones as a second app hidden inside a dropper dressed as a shopping app, a short-drama platform or an adult video service, as Security Affairs reported. The dropper loads real-looking content in a web view and, if a target banking app is present, shows a fake in-app update prompt. One dropper builds a deliberately broken VPN connection during installation that cuts internet access, which ThreatFabric believes is meant to weaken online reputation checks and code analysis, though it does not fully defeat Google Play Protect.
Lure files were hosted on Amazon CloudFront and tracked through OpenInstall attribution tied to Meta Pixel identifiers, and some download routes were still live in late September and October 2026. An operator’s processing panel was reachable without a login, with exposed cloud storage, which let the researchers map the operation. Backend records from August 2026 held thousands of credential entries along with device data and financial profiles, some marked as phished.
That evidence shows an active operation but not its size. ThreatFabric reported no number of infected devices, victims, financial losses or campaign start date, and it did not tie the malware to a named threat actor. The thousands of records are not confirmed victim counts. The code targets users in Indonesia, China, India, Mexico, Morocco and Thailand, the fake checkout uses Malaysian bank and wallet branding, and the bank-specific replacements are all for Indonesian lenders, so exposure to the full banking-app swap is concentrated outside the United States.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
