New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks

A newly identified Android banking Trojan called Hirudo takes an unusual route to financial fraud: it tries to remove a victim’s genuine banking app and install a modified copy in its place.

The replacement keeps the bank app’s name and version, but contains extra code designed to interfere with security checks.

Instead of relying only on fake login screens displayed over a real app, Hirudo’s operators try to make the banking app itself return answers that hide the malware’s presence.

The campaign combines app replacement with credential theft and remote control of infected phones. Its operators can seek banking passwords, payment PINs, SMS messages and device-unlock details, while also viewing the screen and accessing the cameras.

This makes Hirudo more than a fake banking app: it is a remote access Trojan, or RAT, built to help criminals gather information and act on a compromised device.

Analysts from ThreatFabric identified the malware and reported that it has replacement copies prepared for eight Indonesian banking apps covering seven banks.

The researchers also found a wider set of financial apps in Hirudo’s target list, suggesting the operators built a system that could be adapted beyond those banks.

New Android Malware Replaces Legitimate Banking Apps

Hirudo reaches users through apparently useful shopping and entertainment apps. ThreatFabric described lures themed around shopping, adult video and short dramas, including names such as Shopora, 1V1 X, ZoyaTV and KoiShort.

The lure may show real-looking content, such as a storefront or video catalogue, while quietly checking whether the separate Hirudo payload is already installed.

If it is not, the lure displays a fake update prompt and asks the user to install another app package. That second app carries the Trojan and needs its own permissions before its theft and remote-control features can work.

This two-app setup can make the first download appear less suspicious, while the false update persuades the user to install the more dangerous component. It follows a pattern seen in other Android banking threats, such as TrickMo’s abuse of Accessibility permissions.

Once active, Hirudo uses Android’s Accessibility service to detect a targeted banking app and check its signing certificate. It then displays a false update message, opens the system uninstaller for the genuine app and downloads a bank-specific replacement.

The replacement uses the same package name and version as the original, but it is signed with a public test key rather than the bank’s own key. Android will not accept it as an ordinary update over the bank-signed app, so Hirudo first tries to remove the genuine app.

That step creates an important limit: the user may interrupt the uninstall or refuse to approve the replacement installation. But if the modified app is installed, it can load a hidden hooking engine built on the open-source YAHFA and Dobby frameworks.

A hook changes how an app responds when it checks a function or requests information. Hirudo uses this method to interfere with checks from inside the banking app’s own process.

How the banking app is replaced

The engine can return the bank’s genuine signing certificate instead of revealing the test-key signature. It can report an empty list of enabled Accessibility services, hiding the malware’s control service, and remove the FLAG_SECURE setting that blocks screenshots.

The operators may then view or record banking screens remotely. Hirudo also relays some Play Integrity requests to an operator-controlled server, which can return a result for the modified app to accept.

This is why a seemingly successful integrity check does not always prove an app is genuine. ThreatFabric says the attackers’ bundled attestation keybox was publicly leaked, and at least two certificates in it appear on Google’s revocation list.

Banks should check integrity signals on their own servers, including whether certificates have been revoked, and should not rely on a result produced only on a phone that may already be compromised.

Similar credential-stealing Android campaigns, including RatHat’s use of fake app downloads, show why the initial installation path matters as much as later detection.

Beyond replacing banking apps, Hirudo can present fake payment pages and request login passwords or payment PINs.

It can also collect SMS messages, including messages from selected banks and wallets, and in some builds target screen-lock patterns or other unlock details. Its remote-control features include live screen viewing over WebRTC and sessions using the phone’s front or rear camera.

ThreatFabric found that the eight prepared banking-app replacements focus on Indonesia, while the malware’s code includes credential targets in China, India, Mexico, Morocco and Thailand. The fake checkout feature also carries Malaysian bank and wallet branding.

The researchers reported that backend records collected in August 2026 included thousands of credential entries, device information and financial profiles—evidence of an operation designed to organise stolen data for fraud.

Users should be cautious when an app asks them to install an update from outside the official app store, especially if it also requests Accessibility access without a clear need.

Do not remove a banking app or install a replacement at the request of an unfamiliar app. If a banking app disappears unexpectedly or an unfamiliar app requests broad control of the phone, contact the bank using its official contact details and check the device from a trusted channel.

Banks should combine server-side Play Integrity checks with certificate-revocation checks, behaviour monitoring and transaction-risk controls.

They should treat Accessibility and screenshot signals as supporting evidence, not as reliable proof that an app is safe, because Hirudo can tamper with both.

Monitoring should also cover sensitive actions such as login, password recovery, adding a payment beneficiary and approving a transfer. The broader risk is clear: if malware can alter a banking app, signals generated only inside that app may be under an attacker’s control.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248	Shopping lure and dropper — com.agbbh.kjdrttt
SHA-256	0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7	1V1 vip lure and dropper — com.onev.vip
SHA-256	2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b	KoiShort lure and dropper, casino route — com.koishort.app
SHA-256	d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d	ZoyaTV lure and dropper — com.zoyatv.app
SHA-256	425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83	Hirudo RAT, July build — com.zk7qpx.mv9wlt
SHA-256	b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99	Hirudo RAT v7.8.166 — com.r9nkvx.qw2mpl
Domain	www[.]helloharmonyos[.]com	Lure registration and channel configuration
Domain	jiekou[.]baojingtextile[.]cn	RAT configuration API
IP and ports	134[.]122[.]153[.]136:8085, :18085	HTTP API endpoints
IP and ports	134[.]122[.]153[.]136:1883, :1884	MQTT broker
URL	hxxp://43[.]225[.]157[.]157:8766/request_token	Play Integrity relay used by four patched apps
Domain/path	d3s06yhcwfnwcx[.]cloudfront[.]net/apk-fortress/latest.apk	1V1 X download route
Domain	d21gcldn8gp80l[.]cloudfront[.]net	KoiShort casino download route
Domain	dydjjnnjg7jeb[.]cloudfront[.]net	KoiShort short-drama download route
Domain	d3q4tlm7pw29zr[.]cloudfront[.]net	Download host for patched banking apps
IPs and port	134[.]122[.]153[.]68:8080, 134[.]122[.]153[.]92:8080	APK-processing panels
IP	18[.]139[.]79[.]161	APK source host and app-management console

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks appeared first on Cyber Security News.