Hirudo Android malware replaces banking apps to bypass their security checks

ThreatFabric identified Android malware called Hirudo that replaces legitimate banking apps with modified copies to steal credentials and evade security checks. Researchers found malicious copies of eight banking apps and observed impersonation of at least seven Indonesian banks. Apps offering shopping, adult content or short dramas deliver the malware through fake update prompts. After obtaining Accessibility permission, Hirudo removes the real banking app and installs a patched copy whose embedded code alters signature, Accessibility and integrity checks. Operators can collect messages, view screens and control infected phones. The bundled attestation keybox has leaked publicly, and Google lists two certificates as compromised, allowing server-side revocation checks to detect those forgeries.