Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

What it is

Hirudo is an Android banking trojan and RAT tracked by ThreatFabric. It combines on-device credential theft with live remote control of the same phone. It currently targets eight Indonesian banking apps. Internal code suggests it could be retargeted at banks in China, India, Mexico, Morocco and Thailand.

How it works

The dropper arrives inside a fake shopping, adult video or short drama app promoted on social media. It checks whether Hirudo is already installed and installs it if not.

Hirudo then detects which targeted banking app is on the device and shows a fake update prompt. It uninstalls the real app and downloads its own modified, bank-specific replacement.

The replacement carries a hooking engine, so the tampering runs inside the banking app and its self-checks report clean results:

• Signing certificate: the hook returns the genuine certificate and hides the test-key signature.
• Accessibility: the hook returns an empty list of enabled services, so the controlling service is invisible.
• Screen capture and Play Integrity: these checks are also blinded. Hirudo relays Integrity requests through its own server.

Capabilities include:

• WebRTC live screen viewing
• front and rear camera access
• remote interaction through Accessibility
• SMS collection, with a 90-day initial scan plus a configured list of bank and wallet senders

ThreatFabric describes the engine as reusable rather than a bespoke patch.

flowchart LR
    A[Replaced banking app] -->|local signals| B{Trust boundary}
    B -->|forged: cert, Accessibility, integrity| C[App says: clean]
    A -->|server-side signals| D[Backend risk decision]
    D --> E[Behavior, Integrity verdict, transaction risk]

What to do

ThreatFabric's advice to banks:

1. Play Integrity: verify and enforce it server-side. A valid verdict alone is not enough, because Hirudo relays Integrity requests through its own server.
2. Behavioral analytics: layer them on top. Absent behavioral data is itself suspicious.
3. Accessibility and screen-capture signals: treat them as supporting evidence that feeds risk scoring, not as standalone blocking checks, since the fake app can hide its own Accessibility service.
4. Backend transaction-risk controls: keep them at login, credential recovery, beneficiary creation and payment approval. A forged local result cannot substitute for a server-side decision.

Caveats

• The core point is that any signal produced locally by an app that may have been replaced cannot be trusted on its own.
• The page gives no indicators of compromise, package names or the names of the eight targeted banks.
• Targeting beyond Indonesia is inferred from internal code, not observed.