In a concerning development for mobile banking security, researchers have uncovered a new Android malware known as Hirudo, which poses a significant threat by stealing bank account credentials. This sophisticated malware operates by replacing legitimate banking applications with modified versions that effectively disable essential security checks.
Malicious Mechanisms
According to a report from mobile security firm ThreatFabric, Hirudo has been identified as impersonating at least seven banks in Indonesia, while also targeting financial institutions in countries such as China, India, Mexico, Morocco, and Thailand. The malware is typically delivered through seemingly legitimate applications related to shopping (e.g., Shopora), adult content (e.g., 1V1 X), or short drama (e.g., ZoyaTV, KoiShort). These apps serve as loaders for Hirudo, presenting fake “update” notifications that prompt users to grant permissions, including Accessibility services.
Once installed, Hirudo initiates the uninstallation of the genuine banking app, downloads a patched version, and utilizes its Accessibility permissions to complete the installation process. This sequence is delicate and risky, as victims can potentially interrupt the operation at two critical points.
Technical Evasion Tactics
ThreatFabric’s analysis reveals that the malicious version of a banking app retains nearly all of the original app’s code but integrates a hooking engine based on open-source frameworks YAHFA and Dobby. When activated, this patched app employs several evasion tactics:
- Substituting the genuine signing certificate during queries.
- Concealing enabled Accessibility services.
- Disabling screenshot protection, allowing for remote viewing and recording.
- Altering key-attestation certificates and routing Play Integrity requests through an operator-controlled server.
As noted by the researchers, “With the engine running inside the banking app’s own process, the app’s defenses are turned against it.”
Limitations and Risks
Despite its advanced capabilities, ThreatFabric highlights certain limitations in Hirudo’s evasion methods. The bundled attestation keybox has been publicly leaked, and Google has flagged two of its certificates as compromised, enabling server-side revocation checks to detect these forgeries.
Once operational on a device, Hirudo can extract sensitive information such as banking passwords, payment PINs, device unlock secrets, and SMS messages. It can also stream the screen to operators and provide access to both cameras. The malware employs fake checkout pages to collect payment PINs, subsequently displaying fabricated success messages to mislead victims while it siphons off their data.
Implications for Security
ThreatFabric’s findings indicate that Hirudo represents a marked escalation in the tactics employed by Android banking malware, shifting the focus from device-level integrity checks to the security mechanisms inherent in banking applications. The researchers recommend that banks enhance their security measures by validating integrity and attestation on the server side, binding checks to sessions and protected actions, and maintaining behavioral and transaction-risk controls.
For Android users, it is crucial to keep devices updated, avoid installing APK files from unofficial sources, and regularly conduct Play Protect scans to mitigate the risk posed by such malware.
