Severity: High | Priority: 1
Hirudo is an Android banking trojan, tracked by ThreatFabric, that steals credentials and gives attackers live remote control of the victim’s phone. Victims install a lure app, such as a shopping app (Shopora), an adult video app (1V1 X) or a short-drama app (ZoyaTV or KoiShort), from links outside the Google Play Store. The lure then installs the trojan behind a fake “update” prompt.
What sets Hirudo apart is that it uninstalls the victim’s real banking app and installs a patched copy. The copy hides the trojan from the bank’s security checks: it reports the genuine signing certificate, conceals Accessibility services, allows screenshots, and relays Play Integrity checks to the attackers. Hirudo can also:
Its main targets are eight Indonesian banking apps, and its configuration also names financial apps in China, India, Mexico, Morocco, Thailand and Malaysia.
If an alert is raised, identify the phone behind the source address. If the source is your internal DNS server, use its query logs to find the actual client. Your Wi-Fi or DHCP logs, or your mobile device management system, will then link that address to a device and user. Disconnect the phone from your network, and ask the user to stop using banking and payment apps on it.
Then check the phone for:
A banking app reinstalled this way is a strong sign of infection.
An infected phone should be backed up for photos and contacts only, then factory reset. Do not restore apps from that backup. After the reset, reinstall banking apps from the Play Store only.
Next, the user should change, from a different and clean device:
They should also contact their bank to review recent transactions, beneficiaries and linked devices, because the attackers may already hold their credentials.
For organisations whose staff use personal phones on your network, block installation of apps from unknown sources on managed devices. Keep Google Play Protect enabled, and remind users never to install apps or “updates” from links in messages, ads or websites.