Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Summary: ThreatFabric detailed a new Android banking trojan called Hirudo that replaces legitimate banking apps with patched copies carrying a hooking engine that blinds signature, accessibility, screen-capture, and Play Integrity checks from inside the app. The operation targets eight Indonesian banking apps for replacement, with credential targeting spanning Indonesia, China, India, Mexico, Morocco, and Thailand, and is distributed through dropper apps posing as shopping, adult video, and entertainment titles served via fake Google Play landing pages reached through Meta-owned social media ads.
What's compelling: The attestation keybox bundled with the hooking engine is a publicly leaked one, and Play Integrity requests are relayed over plain HTTP to an operator-controlled server that returns the verdict the app accepts - so a valid Integrity response alone no longer proves an app is untampered, and locally produced signals like signature, accessibility list, and integrity verdict must be verified server-side.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026