ThreatFabric has disclosed Hirudo, an Android banking trojan that skips the usual fake login overlay. Instead it uninstalls the genuine banking app and installs a modified copy that disables the app’s own integrity checks from the inside.
How Hirudo Swaps Real Banking Apps for Modified Copies
Most Android banking malware draws a fraudulent screen over a legitimate app. Hirudo replaces the app itself. ThreatFabric reported on October 14 that the trojan removes the original banking application and installs a patched version that has had its protections turned off. Because the replaced app is the one the victim opens, defenses that rely on detecting overlays or tampering have nothing to detect.
The campaign targets banking customers in Indonesia, China, India, Mexico, Morocco and Thailand. The patched apps cover eight Indonesian banking apps from seven banks. Reports differ slightly on the count of impersonated banks, with some describing seven Indonesian banks and others eight apps.
The YAHFA and Dobby Hooking Engine That Disables Security Checks
The modified apps load a hooking engine built on the open-source YAHFA and Dobby projects. It bypasses app-signature, Accessibility and Play Integrity checks by substituting certificate data or returning empty lists. For example, an app that checks whether an Accessibility service is running receives an empty list in response, so the malware’s own use of Accessibility goes unreported to the app.
Droppers Disguised as Shopora, 1V1 X, ZoyaTV and KoiShort
Delivery runs through dropper apps posing as a shopping app called Shopora, an adult video app called 1V1 X, and short drama platforms ZoyaTV and KoiShort. Each loads real content in a WebView and then displays a fake in-app update prompt. Hirudo is installed as a separate app and has to obtain Accessibility and notification permissions from the victim.
A Deliberately Broken VPN Connection
One of the droppers creates a deliberately broken VPN connection during installation. ThreatFabric assesses that this is likely meant to weaken reputation checks and code analysis. The dropper does not fully bypass Google Play Protect, according to the report, so the malware’s evasion has limits.
Hirudo’s Capabilities Behind a Mature Backend
Once installed, Hirudo can steal credentials, give an operator live remote control of the device, capture the screen and camera, steal SMS messages and record audio. ThreatFabric describes the supporting backend as mature, which suggests the operators run the malware as a managed service and not as a one-off tool.
Live remote control matters for fraud. An operator who can see the screen and approve prompts on the victim’s own device can complete transactions that rely on SMS codes or in-app confirmation, since SMS theft and screen capture run in the same toolkit.
No Vendor Patch, and No Announced Bank Response
No vendor patch applies to this threat, because the weakness is not in a banking app but in how victims install software. The risk comes from sideloading apps from untrusted droppers. The sources do not report specific mitigations from the affected banks or from Google, and ThreatFabric’s report does not say how many devices are infected.
Why Replacing the App Changes the Defensive Picture
Overlay detection has been a standard defense for banking apps for years. An approach that never draws an overlay sidesteps that category entirely, and an app that has been patched to answer its own integrity checks incorrectly cannot raise an alarm. The attack therefore moves the point of defense away from the banking app and toward the device, where the checks include whether the user can be induced to install a dropper and grant Accessibility permissions.
The lures show a deliberate choice of low-friction content: a shopping app, adult video and short dramas. These categories draw installs from outside the official store, and the fake update prompt gives the dropper a plausible reason to install a second app. Whether the droppers reached users through official stores or third-party sites is not specified in the reporting.
