A fresh Android banking Trojan named Hirudo is now replacing genuine banking apps on victims’ devices with malicious versions designed to intercept credentials and bypass security protections.
What makes Hirudo dangerous
Rather than relying solely on phishing overlays or fake login screens, Hirudo goes deeper. It drops a counterfeit version of a banking app, replicating its name and version number, but embedding harmful code that subverts the app’s built-in security checks. This allows the malware to mask its modifications from the system.
Once activated, Hirudo can capture banking passwords, payment PINs, SMS messages—including ones used for two-factor authentication—and unlock-patterns. It also turns infected phones into remote access tools, capable of screen recording and accessing cameras.
How it spreads & how it operates
Infected users first download a lure app themed around shopping, short dramas, or adult content—tools that appear harmless. These apps, with names like Shopora, 1V1 X, ZoyaTV, and KoiShort, check if the Hirudo payload is already present. If not, they prompt users to install a second app—this time carrying the Trojan and requesting extensive permissions.
When running, Hirudo monitors for certain banking apps using Android’s Accessibility services. If it sees one, the malware displays a fake update notice, triggers the system uninstaller to remove the genuine app, and then installs the replacement. The fake version uses the same package name and version as the real one, but is signed with a public test key rather than the bank’s official key.
The malicious copy then loads a hidden hooking engine—using open-source tools like YAHFA and Dobby—to mislead checks inside the app. For example, when the banking app checks its signing certificate, Hirudo’s hook can return the genuine one instead of revealing the fake test-key. It may also report no active Accessibility services or disable system protections like screenshot blocking.
Scope, indicators & defensive strategies
Threat researchers found that eight banking apps in Indonesia are prepared replacements targets. But Hirudo’s code also includes other financial apps in China, India, Mexico, Morocco, and Thailand. Malaysian bank and wallet brands figure in the fake payment pages too.
In one August 2026 data capture, backend systems had already collected thousands of credential entries along with device and financial profiles—evidence of a large-scale scheme. Indicators of compromise include specific SHA-256 hashes for Trojan payloads linked to apps like ZoyaTV, KoiShort, and Shopora, and multiple malicious domains and IPs hosting lure or APK files.
Users are warned to avoid installing updates from unknown sources, especially if they request Accessibility access without a clear purpose. If a banking app disappears or an unfamiliar app wants extensive control of your device, reach out to your bank using official channels. Banks, in turn, should verify certificate revocation server-side, monitor transactional risk, and treat in-app signals like screenshot or accessibility status as weaker evidence, since they can be manipulated by malware like Hirudo.
Understanding Hirudo’s methods shows how mobile banking fraud is evolving. By replacing apps entirely rather than just simulating them, this Trojan raises the bar for detection—and forces both users and financial institutions to consider deeper levels of verification. What to watch for next: how well defenses like certificate revocation and server-side integrity checks succeed, and whether similar malware campaigns shift toward other high-value targets.
