Hirudo Tries to Replace Banking Apps With Modified APKs, ThreatFabric Warns
The new Android banking Trojan Hirudo lures users with fake updates and tries to replace their banking app with a modified version.
Security firm ThreatFabric published an analysis of the Hirudo Android RAT malware on October 14. It targets mobile banking using an unusual technique. Instead of overlaying a legitimate banking app with a phishing screen, it tries to uninstall the original app and replace it with a modified APK file.
According to researchers, Hirudo spreads through decoy apps posing as shopping or entertainment tools. They display a fake update prompt that leads to the installation of a separate malicious APK. This file then handles the next stages of the attack.
Hirudo Android RAT Modifies Protections Directly in the App
ThreatFabric found eight purposefully modified replacement banking apps intended for seven Indonesian banks. The modified versions try to bypass multiple security checks directly inside the banking app, including app signature verification, Accessibility mechanisms, screenshot protection and Play Integrity.
This approach differs from common attacks in which a malicious app obtains data by displaying fake login forms over legitimate banking software. With an APK replacement, the attacker changes the app itself—the one the user interacts with. Local checks within it can therefore be manipulated.
The attack also has an important practical limitation. Replacing a banking app requires uninstalling the original version and then allowing installation of the replacement. The user can interrupt this process. The risk mainly affects people who install apps outside trusted stores and grant them sensitive permissions.
Data Collection and Remote Access
According to the analysis, Hirudo can collect login credentials, payment PINs and SMS messages. It also provides operators with remote-access features, including screen viewing and camera access. These capabilities may allow attackers to monitor the victim’s activity and obtain data used to verify transactions.
Researchers said that some distribution channels for the malicious APKs remained active as late as October 2026. However, the number of actually infected devices and the extent of any financial losses were not independently confirmed. It is likewise unconfirmed which specific group is behind the campaign.
Confirmed Targets Are in Indonesia
Replacement banking apps have been confirmed in Indonesia. ThreatFabric also observed code lists suggesting interest in organizations in China, India, Mexico, Morocco and Thailand. However, this is not evidence of active attacks in all of these countries.
The case is especially important for banks because protection cannot rely solely on checks performed directly on the device or in the mobile app. ThreatFabric recommends verifying integrity and attestation on the server, binding checks to a specific session and sensitive operation, and using separate transaction-risk controls.
Further developments will show whether banks or Google publish specific warnings, block indicators or introduce additional measures. Any new samples, domains and APK hashes will also be important, as will confirmed data on infections or the campaign’s spread beyond Indonesia.
Sources
- ThreatFabric — Hirudo: From Fake Updates to Patched Banking Apps – Primary technical analysis of Hirudo, the app-replacement mechanism, targets, capabilities, distribution and recommended mitigations.
- BleepingComputer — Hirudo Android malware replaces banking apps to evade security checks – Independently summarizes ThreatFabric’s findings, including the attack’s limitations and the unknown number of victims.
- SecurityWeek — Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies – Confirms that this is a newly published and relevant development in Android banking malware.
Verified and updated: October 15, 2026 15:19
