A newly identified Android banking malware named Hirudo replaces authentic financial applications with altered versions to disable security checks. Mobile security firm ThreatFabric found the threat impersonating Indonesian institutions, though the malware also targets organizations across Asia, Africa, and North America.
The Hirudo Android malware targets mobile banking users by replacing legitimate banking applications with modified copies that disable local security checks. In an October 2026 report, mobile security company ThreatFabric revealed that malicious actors use the software to steal banking credentials, remotely control compromised devices in real time, collect messages, capture screenshots, and record audio. Researchers observed Hirudo impersonating at least seven Indonesian banks, while also targeting financial institutions in China, India, Mexico, Morocco, and Thailand.
Delivery relies on functional applications across shopping, adult content, or short drama themes. Identified loader programs include Shopora for shopping, 1V1 X for adult media, and ZoyaTV or KoiShort for video dramas. These loader applications display a fake update notice that leads users to grant device permissions, including Accessibility services. Once installed, Hirudo triggers the uninstaller for the genuine banking app, downloads a patched copy, and abuses Accessibility rights to install the replacement. ThreatFabric notes that this is a delicate, risky maneuver for the attackers, because a victim can interrupt the sequence at two distinct points.
Researchers identified modified variants of eight banking apps that retain almost all of their original source code while embedding a runtime hooking engine. This hooking component relies on the open-source YAHFA and Dobby frameworks. By operating directly inside the application, the malware bypasses app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists. The researchers observed: “With the engine running inside the banking app’s own process, the app’s defenses are turned against it.”
When launched, the patched banking application performs specific evasion actions:
ThreatFabric points out limitations in these evasion techniques. The bundled attestation keybox has been leaked publicly, and Google lists two of its certificates as compromised. Server-side revocation checks can therefore identify and block those forged requests.
Once active on a device, Hirudo steals banking passwords, payment PINs, device-unlock secrets, and SMS messages, while streaming the display to operators and accessing both cameras. The software also deploys fake checkout pages designed to harvest payment PINs, showing a fabricated payment-success screen to deceive victims while stealing data. ThreatFabric discovered thousands of application-credential entries stored on an unsecured backend control panel, alongside device identifiers, lock-screen data, and financial profiles. The full number of victims remains unknown.
According to the researchers, “Hirudo marks a deliberate escalation in how Android bankers approach hardened applications,” shifting attention from device-level integrity checks to the protections built into banking apps. The researchers suggest that banks validate integrity and attestation server-side, bind checks to sessions and protected actions, and retain behavioral and transaction-risk controls. Android users are advised to keep devices updated, avoid installing APK files from unofficial sources, and periodically run Play Protect scans.
Google Pixel 11 Pro
Robert Haba is the founder and editor-in-chief of Droid Tools. A lifelong gadget enthusiast with over a decade following the Android ecosystem, he built this publication to cut through the noise and give readers honest, real-world coverage of the tech they actually use.
The ColorOS 17 rollout began on November 5 for OnePlus and realme devices, introducing Fluid Cloud alerts, AI editing tools, and cross-brand file sharing.
A new leak suggests the Huawei Nova 17 series could launch next month with a 200MP main sensor, a 50MP telephoto camera, and a Kirin 8 series chip.
Samsung may open a One UI 9.5 beta soon after test firmware appeared for the Galaxy S26 Ultra, ahead of an expected release alongside the Galaxy S27.
Silicon-carbon batteries push smartphone capacity to 10,000mAh, but full recharge times have grown as phone makers likely prioritize cell longevity.
The next story loads as you reach the end. You can also load it using the button.
Comments & Discussions
Join the conversation! We use Disqus to handle comments. Click the button below to load the comment section.