Play Protect

Researchers have identified a new Android malware called Hirudo, which steals bank account credentials by replacing legitimate banking applications with modified versions that disable security checks. Hirudo impersonates at least seven banks in Indonesia and targets financial institutions in China, India, Mexico, Morocco, and Thailand. It is delivered through seemingly legitimate applications related to shopping, adult content, or short drama, which prompt users to grant permissions, including Accessibility services. Once installed, Hirudo uninstalls the genuine banking app, downloads a patched version, and uses Accessibility permissions to complete the installation. The malicious app retains nearly all of the original app's code but integrates a hooking engine based on open-source frameworks YAHFA and Dobby, employing evasion tactics such as substituting signing certificates, concealing Accessibility services, disabling screenshot protection, and altering key-attestation certificates. Despite its advanced capabilities, Hirudo has limitations, including a publicly leaked attestation keybox and compromised certificates flagged by Google. Once operational, it can extract sensitive information, stream the screen, access cameras, and use fake checkout pages to collect payment PINs while misleading victims with fabricated success messages. Hirudo represents an escalation in Android banking malware tactics, focusing on the security mechanisms of banking applications. Researchers recommend that banks enhance security measures and that Android users keep devices updated, avoid unofficial APK files, and conduct regular Play Protect scans.