Skip to content
Today
Sections

Security Widely confirmed5 publishers 2 min read Published Updated

Patched copies of eight Indonesian banking apps let Hirudo fake the apps' own security checks

Hirudo, an Android trojan, swaps eight Indonesian banking apps for patched copies that blind their own integrity checks, ThreatFabric says. The victim must approve the swap, and afterwards the app's checks answer as the operator scripts them.

The Watch · Security desk

Send a correction

Illustration accompanying Patched copies of eight Indonesian banking apps let Hirudo fake the apps' own security checks
Generated illustration
Patched bank-app copies answer the apps' own checks Where Hirudo's swap of banking apps for patched copies reaches the apps and their checks, and what the swap needs first

Map of parties. Banking apps: a hooking engine in the copy blinds their checks. Play Integrity: an operator-controlled server returns the verdict. Genuine app: must be removed first. Hirudo RAT: needs its own permissions. Play Protect: offline detection remains.

Patched bank-app copies answer the apps' own checks
WhoHowKindClaim
Targeted banking appsHooking engine in the copy blinds signature, accessibility, screen-capture and Play Integrity checksexposure4
Play Integrity verdictsRequests go over plain HTTP to an operator-controlled server, which returns the verdictexposure13
Genuine banking appMust be removed before the copy installs, a "real constraint" per The Hacker Newsconstraint10
Hirudo RATInstalled as a second app, it must be granted its own permissions before it actsconstraint7
Google Play ProtectVPN block does not fully disable it; offline detection remains, per ThreatFabriccapability17

What happened

  • Shopping, adult video and entertainment dropper apps carry the trojan as a separate package and serve it to the victim as an in-app update.
  • Before the payload installs, the malware sets up a non-functional VPN to cut internet access and keep cloud-based checks such as Play Protect from scanning it.
  • The RAT spots a targeted bank app through accessibility, compares its signing certificate with a stored reference, then shows a fake update prompt.
  • Inside the replacement, queries return the genuine signing certificate and an empty list of accessibility services, and FLAG_SECURE is stripped so screens can be recorded remotely.
  • Credential targeting in the malware covers Indonesia, China, India, Mexico, Morocco and Thailand.

Why it matters

  • What it limits constraint Signature, accessibility and Play Integrity checks that run inside the banking app tell a bank little about a phone carrying one of these copies.
  • Who has to decide decision Banks have to decide how much weight to give an integrity verdict that is produced inside their own app.
  • Who's exposed exposure Victims are exposed only after they approve permissions and an uninstall, so each approval is a point where the chain can stop.
  • What it costs cost Each targeted bank needs its own replacement build, so widening the technique costs the operator one patched app at a time.

The chain asks a lot of the victim. The dropper checks whether the payload is already installed with its accessibility service and notification access enabled, and if it is not, it shows a fake in-app update prompt [6]. Hirudo installs as a second app and must be granted its own permissions before it can act [7]. Each of those is a prompt the user can refuse. Then the genuine bank app has to go. The Hacker News calls the need to remove it a "real constraint" [10], and the RAT narrows it by opening Android's uninstaller without waiting for a tap while it downloads the bank-specific replacement in parallel [9].

In our view, any check the app evaluates in its own process answers to whoever built that process. Here the answer is explicit: a keybox shipped with the app is used to re-sign key-attestation certificates, and Play Integrity requests go out over unencrypted HTTP to a server the operator controls, which sends back a verdict for the app to accept [13].

The VPN trick does not switch Play Protect off. ThreatFabric noted in an earlier assessment that Play Protect also provides offline detection for known potentially harmful applications, and judged the technique more likely meant to reduce the effectiveness of online reputation and code-analysis checks than to bypass Play Protect entirely [17]. The Hacker News notes the same technique was observed in StreamRat [16].

Overlays and remote control are "par for the course" for Android banking trojans, according to The Hacker News, which singles out the tampered banking copy as the part that stands out [14]. The replacement technique is documented against Indonesian apps only [2].

"The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," Eward Driehuis, ThreatFabric's vice president of fraud engineering, said in a statement shared with The Hacker News [11].

What to watch

  • Patched replacements for banks outside Indonesia, since credential targeting already covers five other countries.
  • New dropper packages beyond Shopora, 1V1 X, KoiShort and ZoyaTV, and any change to how they are served as updates.
  • Any bank or Google response on Play Integrity verdicts relayed through a patched app.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption
Not scored
Hype gap−5
Incentives
Not scored
Confidence70

Perspective Coverage

5 publishers
Builder
Builder 27%
Operator
Operator 51%
Investor
Investor 22%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Hirudo is a new Android banking trojan that replaces legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  2. [2]

    ThreatFabric identified replacements for eight Indonesian banking apps.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  3. [3]

    Credential targeting in the Hirudo malware spans Indonesia, China, India, Mexico, Morocco and Thailand.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  4. [4]

    The purpose-built replacement apps embed a hooking engine to blind signature, accessibility, screen-capture and Play Integrity checks from within the app.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  5. [5]

    Hirudo is delivered by shopping, adult video and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  6. [6]

    The dropper's startup routine collects promotion-tracking data, fetches its campaign configuration and checks whether the Hirudo RAT is already installed with its accessibility service and notification access enabled; if it is not present, the dropper displays a fake in-app update prompt to trigger installation.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  7. [7]

    Hirudo is installed as a second app and must be granted its own permissions before it can carry out malicious activities.

    Reported Supported Source: The Hacker NewsView cited source
  8. [8]

    For a targeted banking app, the RAT detects the installed app through accessibility, checks its signing certificate against a stored reference, then shows a fake update prompt.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  9. [9]

    The RAT opens Android's uninstaller for the genuine banking app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  10. [10]

    The need to remove the genuine app before installing the near-identical malicious copy is described as a "real constraint", but the mechanism lets the copy bypass the banking app's own security checks by returning responses fed by the attacker beforehand.

    Reported Supported Source: The Hacker NewsView cited source
  11. [11]

    "The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," said Eward Driehuis, vice president of fraud engineering at ThreatFabric, in a statement shared with The Hacker News.

    Reported Supported Source: Eward Driehuis, ThreatFabricView cited source
  12. [12]

    The replacement apps return the genuine app signing certificate, return an empty list when queried for enabled accessibility services, and strip the FLAG_SECURE flag so the app's screens can be viewed and recorded remotely.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  13. [13]

    Key-attestation certificates are re-signed with a bundled keybox, and Play Integrity requests are relayed over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source
  14. [14]

    The Hacker News describes the overlay and remote-control behavior as par for the course for Android banking trojans, and says the attempt to replace the target banking app with a tampered copy is what stands out.

    Reported Supported Source: The Hacker NewsView cited source
  15. [15]

    Before the payload is installed, the malware configures a deliberately non-functional VPN connection to block Internet access, an attempt to prevent other apps and services, such as Google Play Protect, from carrying out cloud-based checks of the payload.

    Reported Supported Source: The Hacker NewsView cited source
  16. [16]

    The non-functional VPN anti-detection technique was observed in the case of StreamRat.

    Reported Supported Source: The Hacker NewsView cited source
  17. [17]

    ThreatFabric noted that Play Protect also provides offline detection for known potentially harmful applications, so the VPN technique does not completely disable its protection, and assessed that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms than to bypass Play Protect entirely.

    Reported Supported Source: ThreatFabric, as reported by The Hacker NewsView cited source

Sources

5 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · October 14, 2026

    Hirudo Android malware replaces banking apps to evade security checks
  2. dev.to

    1 article · October 15, 2026

    Hirudo: Replaces Banking Apps to Tamper with Local Signature, Accessibility, and Play Integrity Checks
  3. securityaffairs.com

    1 article · October 14, 2026

    Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
  4. securityweek.com

    1 article · October 15, 2026

    Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
  5. thehackernews.com

    1 article · October 14, 2026

    Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Topics and entities

Topics

Entities