The discovery of Hirudo, a sophisticated Android banking trojan, highlights an important evolution in mobile financial fraud: attackers are moving beyond stealing banking credentials through fake applications and are now attempting to compromise the security mechanisms built into legitimate banking applications.

According to researchers at ThreatFabric, Hirudo can replace genuine banking applications with modified versions designed to bypass security checks while preserving much of the original application's functionality.

The malware is distributed through seemingly legitimate shopping and entertainment applications. Once installed, it uses deceptive update prompts and requests sensitive Android permissions, particularly Accessibility access, to gain control over the device.

What makes Hirudo particularly concerning is its approach to defeating application security.

Instead of merely displaying a fake login screen over a legitimate banking application, the malware attempts to uninstall the genuine application and install a modified replacement containing a hooking engine.

This engine can manipulate the results of security checks performed by the banking application, including application signature verification, Accessibility service detection, screen-capture restrictions and device integrity validation.

Consequently, a compromised application may report that its security environment is trustworthy even when attackers have modified its behavior.

The malware also supports credential theft, SMS interception, screen recording, remote device control and access to cameras. These capabilities can potentially allow attackers to observe sensitive banking activities, capture authentication information and manipulate user interactions.

ThreatFabric identified modified versions of eight banking applications associated with seven Indonesian banks, while the malware's broader targeting information includes financial institutions in other countries, including India.

The incident raises a fundamental question for financial institutions: how much trust should be placed in security checks performed entirely within a mobile application?

If attackers can replace or manipulate the application, locally generated security results may no longer provide reliable evidence of device or application integrity.

This reinforces the importance of server-side verification, cryptographically bound integrity checks, transaction-level risk assessment and behavioral fraud detection.

Banks should evaluate sensitive actions such as beneficiary creation, password recovery and payment authorization independently of the security status reported by the mobile application.

For users, the incident highlights the dangers of installing applications from unofficial sources, granting unnecessary Accessibility permissions and accepting unexpected banking application updates.

The broader lesson is that mobile banking security must extend beyond protecting login credentials or verifying the application at startup.

When attackers can influence the application itself, security decisions must be enforced through independent controls that the compromised application cannot simply override.

As mobile banking threats become more sophisticated, financial institutions must adopt layered security architectures that combine application integrity, identity verification, transaction monitoring and continuous behavioral analysis.

A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]

Source: Hirudo Android malware replaces banking apps to evade security checks via Bleeping Computer — published 14 Oct 2026.