Most people trust their banking app more than anything else on their phone. Hirudo, a new Android malware family, goes straight after that trust. Instead of faking a login screen, it deletes the real app and installs a rigged copy. The copy looks the same and works the same, but its security checks no longer do.
How Hirudo Android malware lands on a phone
The campaign starts with apps that do exactly what they advertise. Researchers traced the loaders to a shopping app called Shopora, an adult app named 1V1 X, and two short drama apps, ZoyaTV and KoiShort. Each one works, so the user gets what they came for and stops looking. Later, the app shows a fake update notice and asks for a run of permissions.
One permission in that list matters far more than the rest. Android built Accessibility for people with disabilities, so it lets an app read the screen and tap buttons for you. Hirudo needs that power, because the rest of the attack runs on automated taps. Once the switch is on, the Hirudo Android malware can drive the phone almost as freely as its owner.
Swapping the real bank app for a rigged copy
The swap is the part that sets the Hirudo Android malware apart from older banking trojans. It opens the uninstaller for the real banking app, downloads a patched version, then taps through the install by itself. From the outside it looks like a normal update. The icon never changes, and the login still works first time.
The routine carries real risk for the attackers as well. It breaks at two points if the victim watches the screen and cancels. Most people never look, however, so the gamble pays off often enough. Eight banking apps already have rigged copies in circulation.
Defences turned against the app
A patched app keeps nearly all of the original code, which is why it still works. The attackers add a hooking engine built on two open source frameworks, YAHFA and Dobby. That engine runs inside the banking app’s own process. From there the Hirudo Android malware catches each security check and hands back a clean answer.
Each change the engine makes is small, targeted and easy to miss. The patched app hands over the real signing certificate when something asks how it was signed. It hides any active Accessibility services, so the app’s own abuse check comes back clean. It also drops screenshot protection, which lets operators watch and record screens that should be locked.
Google’s integrity tooling gets the same treatment from this malware. It edits the key attestation certificates and routes Play Integrity requests through a server the attackers run. The check then comes back positive on a fully compromised phone. That is the signal banks are supposed to be able to trust.
What Hirudo Android malware can do once it is inside
Full remote control of the phone comes with the package. Operators can take banking passwords, payment PINs, unlock codes and text messages. They can stream the screen live, pull video from both cameras, record audio and grab screenshots. In practice the attacker sits beside the victim with a perfect view.
One trick in the kit deserves a mention of its own. Fake checkout pages collect the payment PIN, then show a clean payment success screen. The victim walks away believing the money moved normally. Researchers also found thousands of stolen credentials in an exposed backend panel, along with device and lock screen data.
Who is in the crosshairs
Indonesia is the clear focus, with at least seven of the country’s banks copied so far. The Hirudo Android malware also reaches banks in China, India, Mexico, Morocco and Thailand. Nobody knows the real victim count yet. That spread points to a crew testing one model in several markets at once.
The flaw the attackers cannot fix
The evasion works well, but it carries a weakness nobody can patch away. The attestation keybox inside these apps has already leaked in public. Google lists two of its certificates as compromised. Banks that check properly on their own servers can catch the forgery before a session starts.
The real fix sits on the bank’s side of the connection. Integrity and attestation checks belong on the server, not on the phone. Banks should tie those checks to the session and to each protected action. Risk scoring on transactions still earns its keep.
How to keep the Hirudo Android malware off your phone
Defence here comes down to habits rather than any single product you can buy. Install apps from Google Play, never from third party APK sites. Sideloading is the doorway this family walks through.
It also pays to watch what happens after an update prompt. Treat any in app update that asks for Accessibility as a red flag. A banking app that wants to uninstall and reinstall itself is never acting on your bank’s orders. Run a Play Protect scan now and then, and keep the phone updated.
A VPN will not block a malicious APK, and nobody should buy one expecting that. It does close other gaps though, since it encrypts traffic on public Wi-Fi and hides your browsing from the network. Some providers, NordVPN and Surfshark among them, also bundle filters that block known malicious domains. That can cut off a loader before it fetches the next stage.
Final Thoughts
Android banking trojans used to attack app defences from outside, and hardening answered that well. The Hirudo Android malware moves inside the process and turns those defences off. Banks will have to move their trust decisions to the server, where a hooking engine cannot reach them.
Users still hold the strongest card in this game. Nothing starts without a sideloaded app, a fake update and an Accessibility prompt nobody should accept. Three small refusals break the whole chain, and they cost nothing.
