Researchers at ThreatFabric have documented a new Android banking trojan, Hirudo, that replaces legitimate banking apps with tampered copies designed to bypass the apps' own security checks. Both BleepingComputer and The Hacker News describe the same campaign; the latter adds that the replacements target eight Indonesian banking apps while credential theft spans Indonesia, China, India, Mexico, Morocco, and Thailand.
According to The Hacker News, Hirudo uses Android accessibility services to detect an installed banking app, verify its signing certificate, and then prompt the user to "update" it. Behind the scenes, it opens the system uninstaller for the genuine app and downloads a patched replacement. That replacement embeds a hooking engine that feeds false responses to security checks: it returns the original signing certificate, reports no enabled accessibility services, strips the FLAG_SECURE flag, and relays Play Integrity requests to an operator-controlled server. BleepingComputer's shorter report agrees on the central detail: the modified apps disable security checks.
Delivery relies on dropper apps for shopping, adult video, and entertainment, plus fake Google Play landing pages promoted through social media ads. The malware also blocks internet access with a non-functional VPN before installation, which ThreatFabric says is likely meant to hamper cloud-based reputation checks rather than fully disable Play Protect. ThreatFabric warns that once an app is replaced, its locally produced signals—signature, accessibility list, and integrity verdict—must be treated as attacker-influenced and verified server-side.