Hirudo: The Trojan That Deceives Banking Apps From Within by Replacing Them With Patched Copies

A new Android malware dubbed Hirudo has changed how banking trojans attack protected applications. Discovered by ThreatFabric and documented on October 14, 2026, Hirudo does not merely overlay fraudulent interfaces: it uninstalls the legitimate banking app and replaces it with a patched copy that embeds a hooking engine in its own process. This technique neutralizes client-side integrity checks, rendering unreliable the signals banks have relied on for years to verify device security.

How It Works: The App-Replacement Attack That Lowers the Drawbridge

Hirudo enters the device via seemingly legitimate droppers. Once active, it presents a fake update notification that triggers installation of the main payload with Accessibility permissions. From there, the malware launches the system uninstaller for the real banking app while simultaneously downloading the institution-specific patched copy.

The process is technically delicate and can be interrupted by the victim at least twice, according to ThreatFabric's analysis. If the user does not stop the operation, however, the result is a banking app nearly identical to the original: it retains almost all genuine code but loads a hooking engine in its own process that modifies the behavior of internal security checks.

The engine relies on YAHFA and Dobby, open-source frameworks well known in the mobile research community. The choice is deliberate: these tools allow interception of native and Java method calls without requiring custom exploits for each target application. The paradigm shifts from artisanal patching to a reusable engine, with a significantly lower barrier to replicating the attack on other apps and regions.

"With the engine running inside the banking app's own process, the app's defenses are turned against it" — ThreatFabric researchers

The Specific Bypasses: When Client-Side Checks Lie to the Server

Hirudo demonstrates that defense mechanisms distributed in banking apps can be compromised if the app itself is the one lying. The engine intercepts four categories of verification: the application signature, replaced with the genuine certificate when queried; Accessibility services, for which it returns an empty list hiding its own permissions; the FLAG_SECURE screenshot protection, removed to allow remote screen viewing and recording; and Play Integrity requests, relayed via plaintext HTTP to an operator-controlled server that returns a valid verdict.

The hardware attestation mechanism is also compromised. The keybox bundled with Hirudo was publicly leaked, and Google revoked two of its certificates. This does not eliminate the malware's ability to operate — the relay to an external server remains functional — but indicates that the attestation infrastructure is not immune to reuse of exposed materials.

The Exposed Backend and Geographic Ambition

Beyond the replacement mechanism, Hirudo features a mature command-and-control infrastructure. An unprotected backend panel contained thousands of entries with application credentials. The system manages multiple campaigns, profiles victims with data such as monthly income and risk score, and coordinates collection of banking passwords, payment PINs, device unlock secrets, SMS, screen streaming, and access to both cameras.

Fake checkout pages complete the theft by collecting the payment PIN with a bogus successful transaction outcome. The operation is not limited to Indonesia: ThreatFabric identified targets in China, India, Mexico, Morocco, and Thailand, for a total of at least seven countries. This geographic distribution suggests the infrastructure is built to scale, not to hit an isolated market.

Anti-Detection and Limits of the Play Protect Bypass

Hirudo implements an anti-detection technique that attempts to block internet access before payload installation, using a non-functional VPN. The goal is to prevent Google Play Protect's cloud check. The measure, however, is partial: Play Protect retains offline detection, so the bypass is incomplete.

Distribution occurs via web pages impersonating the Google Play Store, with users directed through ads on Meta-owned platforms. The dropper apps — shopping, adult content, short drama categories — are functional to avoid suspicion, increasing the likelihood users grant the necessary permissions.

What to Do Now

For Android users: Never install banking apps via links received in ads or messages; verify installation occurs exclusively from the official Google Play Store; pay attention to Accessibility permission requests from unrecognized apps; check that the banking app's icon and name match the original exactly, including details often poorly cloned.

For financial institutions: Treat all client-side integrity signals as unreliable if the app can be replaced; move critical verifications server-side with binding to user session; monitor anomalies in installation patterns and attestation API usage; evaluate the need for independent communication channels for high-risk transactions.

For mobile security teams: Analyze the presence of hooking frameworks in apps installed on managed devices; implement detection of anomalous behavior in the application lifecycle; consider remote attestation that does not rely solely on local keyboxes.

For advertising platform operators: Strengthen advertiser verification for those distributing financial apps, with reactive checks on landing pages impersonating official stores.

Why Hirudo Changes the Mobile Security Game

The transition from overlay to complete app replacement is not an incremental improvement: it is a paradigm shift. As long as trojans operated outside the banking app, integrity checks could at least detect the anomaly in context. When the app itself is the anomaly, built with original code but altered behavior, local signals become indistinguishable from legitimate ones.

The use of a reusable hooking engine lowers the barrier to extending this technique. It is no longer necessary to engineer a bespoke patch for each institution: YAHFA and Dobby provide the infrastructure, the rest is adaptation. This explains the operation's geographic ambition and backend maturity: the infrastructure investment pays off if the engine can be retargeted.

The question Hirudo poses to banks is deeper than the immediate technical response. If the signature, hardware attestation, and even Play Integrity can be relayed or spoofed from inside the app, what guarantor remains valid? The answer, suggested by ThreatFabric itself, is that verification must move to the server and binding must be to the session, not the device. The trust perimeter shrinks, and the cost of security shifts to institutional infrastructure.

Limits and Points Still to Verify

The dossier does not specify the exact number of confirmed victims nor whether target banks have issued their own advisories to customers. No infrastructure overlaps emerge linking Hirudo to previous campaigns or known APT groups at this stage. The precise geographic origin of the operators remains unattributed. It is not documented whether Google Play Protect has updated detection signatures for the specific droppers identified by ThreatFabric.

Sources

• https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/
• https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html
• https://www.infosectoday.io/hirudo-android-trojan-uses-patched-banking-apps-to-bypass-their-built-in-security-checks/?doing_wp_cron=1791980627.4870960712432861328125
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://www.bleepingcomputer.com/download/
• https://deals.bleepingcomputer.com/
• https://www.bleepingcomputer.com/vpn/

Information verified against cited sources and current as of publication.

Sources