Patched copies of eight Indonesian banking apps let Hirudo fake the apps' own security checks
Hirudo, an Android trojan, swaps eight Indonesian banking apps for patched copies that blind their own integrity checks, ThreatFabric says. The victim must approve the swap, and afterwards the app's checks answer as the operator scripts them.
The Watch · Security desk
Map of parties. Targeted banking apps: a hooking engine in the copy blinds their checks. Play Integrity: requests are relayed to an operator-controlled server that returns the verdict. Genuine app: must be removed first. Hirudo: needs its own permissions. Play Protect: keeps offline detection.
- exposure Targeted banking apps A hooking engine in the copy blinds signature, accessibility, screen-capture and Play Integrity checks, claim 6
- exposure Play Integrity verdicts Relayed over plain HTTP to an operator-controlled server that returns the verdict, claim 11
- constraint Genuine banking app Must be removed before the malicious copy installs, a "real constraint" per The Hacker News, claim 9
- constraint Hirudo RAT Installed as a second app, it must be granted its own permissions before it acts, claim 5
- capability Google Play Protect Keeps offline detection of known harmful apps despite the VPN block, ThreatFabric notes, claim 15
| Who | How | Kind | Claim |
|---|---|---|---|
| Targeted banking apps | A hooking engine in the copy blinds signature, accessibility, screen-capture and Play Integrity checks | exposure | 6 |
| Play Integrity verdicts | Relayed over plain HTTP to an operator-controlled server that returns the verdict | exposure | 11 |
| Genuine banking app | Must be removed before the malicious copy installs, a "real constraint" per The Hacker News | constraint | 9 |
| Hirudo RAT | Installed as a second app, it must be granted its own permissions before it acts | constraint | 5 |
| Google Play Protect | Keeps offline detection of known harmful apps despite the VPN block, ThreatFabric notes | capability | 15 |
What happened
- Shopping, adult video and entertainment dropper apps carry the trojan as a separate package and serve it to the victim as an in-app update.
- Before the payload installs, the malware sets up a non-functional VPN to cut internet access and keep cloud-based checks such as Play Protect from scanning it.
- The RAT spots a targeted bank app through accessibility, compares its signing certificate with a stored reference, then shows a fake update prompt.
- Inside the replacement, queries return the genuine signing certificate and an empty list of accessibility services, and FLAG_SECURE is stripped so screens can be recorded remotely.
- Credential targeting in the malware covers Indonesia, China, India, Mexico, Morocco and Thailand.
Why it matters
- constraint Signature, accessibility and Play Integrity checks that run inside the banking app tell a bank little about a phone carrying one of these copies.
- decision Banks have to decide how much weight to give an integrity verdict that is produced inside their own app.
- exposure Victims are exposed only after they approve permissions and an uninstall, so each approval is a point where the chain can stop.
- cost Each targeted bank needs its own replacement build, so widening the technique costs the operator one patched app at a time.
The chain asks a lot of the victim. The dropper checks whether the payload is already installed with its accessibility service and notification access enabled, and if it is not, it shows a fake in-app update prompt [4]. Hirudo installs as a second app and must be granted its own permissions before it can act [5]. Each of those is a prompt the user can refuse. Then the genuine bank app has to go. The Hacker News calls the need to remove it a "real constraint" [9], and the RAT narrows it by opening Android's uninstaller without waiting for a tap while it downloads the bank-specific replacement in parallel [8].
In our view, any check the app evaluates in its own process answers to whoever built that process. Here the answer is explicit: a keybox shipped with the app is used to re-sign key-attestation certificates, and Play Integrity requests go out over unencrypted HTTP to a server the operator controls, which sends back a verdict for the app to accept [11].
The VPN trick does not switch Play Protect off. ThreatFabric noted in an earlier assessment that Play Protect also provides offline detection for known potentially harmful applications, and judged the technique more likely meant to reduce the effectiveness of online reputation and code-analysis checks than to bypass Play Protect entirely [15]. The Hacker News notes the same technique was observed in StreamRat [14].
Overlays and remote control are "par for the course" for Android banking trojans, according to The Hacker News, which singles out the tampered banking copy as the part that stands out [16]. The replacement technique is documented against Indonesian apps only [2].
"The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," Eward Driehuis, ThreatFabric's vice president of fraud engineering, said in a statement shared with The Hacker News [12].
What to watch
- Patched replacements for banks outside Indonesia, since credential targeting already covers five other countries.
- New dropper packages beyond Shopora, 1V1 X, KoiShort and ZoyaTV, and any change to how they are served as updates.
- Any bank or Google response on Play Integrity verdicts relayed through a patched app.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Hirudo is a new Android banking trojan that replaces legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself.
- [2]
ThreatFabric identified replacements for eight Indonesian banking apps.
- [3]
Hirudo is delivered by shopping, adult video and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.
- [4]
The dropper's startup routine collects promotion-tracking data, fetches its campaign configuration and checks whether the Hirudo RAT is already installed with its accessibility service and notification access enabled; if it is not present, the dropper displays a fake in-app update prompt to trigger installation.
- [5]
Hirudo is installed as a second app and must be granted its own permissions before it can carry out malicious activities.
- [6]
The purpose-built replacement apps embed a hooking engine to blind signature, accessibility, screen-capture and Play Integrity checks from within the app.
- [7]
For a targeted banking app, the RAT detects the installed app through accessibility, checks its signing certificate against a stored reference, then shows a fake update prompt.
- [8]
The RAT opens Android's uninstaller for the genuine banking app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.
- [9]
The need to remove the genuine app before installing the near-identical malicious copy is described as a "real constraint", but the mechanism lets the copy bypass the banking app's own security checks by returning responses fed by the attacker beforehand.
- [10]
The replacement apps return the genuine app signing certificate, return an empty list when queried for enabled accessibility services, and strip the FLAG_SECURE flag so the app's screens can be viewed and recorded remotely.
- [11]
Key-attestation certificates are re-signed with a bundled keybox, and Play Integrity requests are relayed over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept.
- [12]
"The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," said Eward Driehuis, vice president of fraud engineering at ThreatFabric, in a statement shared with The Hacker News.
- [13]
Before the payload is installed, the malware configures a deliberately non-functional VPN connection to block Internet access, an attempt to prevent other apps and services, such as Google Play Protect, from carrying out cloud-based checks of the payload.
- [14]
The non-functional VPN anti-detection technique was observed in the case of StreamRat.
- [15]
ThreatFabric noted that Play Protect also provides offline detection for known potentially harmful applications, so the VPN technique does not completely disable its protection, and assessed that the technique is more likely intended to reduce the effectiveness of online reputation and code-analysis mechanisms than to bypass Play Protect entirely.
- [16]
The Hacker News describes the overlay and remote-control behavior as par for the course for Android banking trojans, and says the attempt to replace the target banking app with a tampered copy is what stands out.
- [17]
Credential targeting in the Hirudo malware spans Indonesia, China, India, Mexico, Morocco and Thailand.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHirudo Android malware replaces banking apps to evade security checks
1 article · October 14, 2026
- thehackernews.comHirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Android MalwareFollow
- Mobile Banking FraudFollow
- App integrity and attestationFollow
Entities
- Eward DriehuisFollow
- HirudoFollow
- StreamRatFollow
- ThreatFabricFollow
- Google Play ProtectFollow
- Play Integrity APIFollow