Hirudo Malware Disrupts Banking Apps with Advanced Evasion Tactics

"With the engine running inside the banking app's own process, the app's defenses are turned against it," ThreatFabric writes.

How Hirudo replaces legitimate banking apps

ThreatFabric's analysis shows Hirudo does not merely mimic bank apps — it replaces them. After a victim installs a seemingly legitimate loader app, Hirudo launches the real banking app’s uninstaller, downloads a patched copy of the banking app, and uses granted Accessibility privileges to install that patched version. The malicious copy preserves almost all of the original app’s code but injects a hooking engine into the banking app’s process.

The researchers note this replacement sequence is fragile: victims can interrupt the operation at two different points, making successful installation a delicate, risky process for the malware operators.

Evasion techniques: hooking engine, attestation keybox, and Accessibility

ThreatFabric found the patched banking apps load a hooking engine built on the open-source frameworks YAHFA and Dobby. That engine carries out a set of evasive actions inside the banking app itself:

• Substitute the genuine signing certificate when the app queries it.
• Hide enabled Accessibility services so the app appears not to be using them.
• Remove screenshot protection, allowing operators to view and record the screen remotely.
• Modify key-attestation certificates and relay Play Integrity requests through an operator-controlled server.

The researchers caution there are constraints on these methods. The bundled attestation keybox used by Hirudo has been publicly leaked, and Google lists two of its certificates as compromised; server-side revocation checks can therefore detect those forgeries.

Delivery: Shopora, 1V1 X, ZoyaTV, and KoiShort act as loaders

Hirudo is typically delivered through apps that appear to provide legitimate services. ThreatFabric identified loaders distributed as shopping (Shopora), adult content (1V1 X), or short-drama streaming (ZoyaTV, KoiShort) apps. These apps present a fake “update” notification that leads users into permission-granting prompts, including requests for Accessibility services — a critical privilege Hirudo exploits to complete the replacement and installation process.

Impact: credential theft, remote control, and exposed backend data

Once active, Hirudo gives operators extensive access to victims' devices. ThreatFabric lists the malware's capabilities as including theft of banking passwords, payment PINs, device-unlock secrets, and SMS messages; streaming the device screen to operators in real time; capturing screenshots; recording audio; and accessing both cameras. The patched apps also present fake checkout pages that harvest payment PINs and then show a fabricated payment-success message to keep victims unaware.

ThreatFabric observed malicious copies impersonating at least seven Indonesian banks and noted the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand. The researchers found thousands of application-credential entries in an unsecured backend panel operated by the actors, together with device, lock-screen, and financial-profile data. ThreatFabric did not determine the total number of victims.

What this means for banks, Android users, and security teams

Banks: ThreatFabric recommends that banks validate integrity and attestation server-side, bind integrity checks to sessions and to protected actions, and retain behavioral and transaction-risk controls. The key point: when attackers shift to attacking app-level defenses, server-side verification and risk controls become primary lines of defense.

Android users: The researchers strongly recommend keeping devices up to date, avoiding installation of APK files from unofficial Android stores, and periodically running Play Protect scans. These steps aim to reduce the chance a device will accept the loader apps and grant the Accessibility permissions Hirudo needs.

Security teams: The discovery highlights the need to watch for malicious wrappers and patched binaries that retain legitimate app code while inserting hooking engines. Teams should monitor for unusual Play Integrity or attestation relays, unexpected Accessibility service registrations, and unsecured backend panels that expose harvested credentials.

ThreatFabric characterizes Hirudo as “a deliberate escalation in how Android bankers approach hardened applications,” noting a strategic shift from targeting device-level integrity to undermining the security mechanisms that banking apps themselves rely on. The finding — thousands of harvested credential records in an exposed backend and a set of evasive techniques executed inside genuine app processes — underscores how attackers are adapting tools like YAHFA and Dobby to turn app defenses into attack surfaces. How quickly banks and platform defenders can move integrity checks and risk controls onto trusted server-side paths will be central to blunting this class of attack.

Original report: https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/