"The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," Eward Driehuis, vice president of fraud engineering at ThreatFabric, said in a statement shared with The Hacker News.
Delivery: dropper apps, fake Play pages, and ads on Meta platforms
ThreatFabric traced Hirudo’s delivery to a class of dropper applications that present legitimate content — storefronts, short dramas, or video catalogues — while secretly preparing a second installation package: the Hirudo RAT. The company identified several of those droppers by package name, including Shopora (com.agbbh.kjdrttt), 1V1 X (com.onev.vip), KoiShort (com.koishort.app), and ZoyaTV (com.zoyatv.app).
The droppers fetch campaign configuration and check whether Hirudo is already installed with its accessibility service and notification access enabled. If it is not present, the dropper displays a fake in‑app update prompt that attempts to install Hirudo as a separate app. ThreatFabric also reports the operation uses fake web pages masquerading as Google Play Store landing pages and that users are assessed to be directed to those pages through ads on Meta‑owned social media platforms.
Patched replacements: a hooking engine that moves tampering inside target apps
What sets Hirudo apart is its effort to replace legitimate banking apps with purpose‑built, near‑identical malicious copies. ThreatFabric observed replacements for eight Indonesian banking apps. Those replacements embed a hooking engine designed to neutralize the apps’ own security checks from inside the app itself.
According to ThreatFabric, the replacements can return a genuine app signing certificate, report an empty list when queried for enabled accessibility services, and strip Android’s FLAG_SECURE so screens can be viewed and recorded. The RAT detects the installed banking app through accessibility, checks its signing certificate against a stored reference, then shows a fake "update" prompt. It opens Android’s uninstaller for the genuine app without waiting for the user to tap and downloads the bank‑specific replacement in parallel — a mechanism that, while constrained by the need to remove the app first, allows attacker‑fed responses to supplant locally produced signals.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAnti-detection techniques: faux VPN, Play Protect limits, and relayed Play Integrity
Hirudo uses multiple anti‑detection steps. Before installing the payload, the dropper configures a deliberately non‑functional VPN connection, which ThreatFabric says is likely intended to reduce the effectiveness of online reputation and code‑analysis mechanisms. The report notes this does not completely disable Google Play Protect because Play Protect also provides offline detection for known potentially harmful applications.
The malicious replacements also manipulate attestation and integrity checks. Key‑attestation certificates are re‑signed with a bundled keybox, and Play Integrity requests are relayed over plain HTTP to an operator‑controlled server that returns a verdict for the app to accept. ThreatFabric underlines two details for defenders: the attestation keybox bundled with the engine is not the operators’ own but a publicly leaked keybox, and because Integrity requests are relayed rather than genuinely produced, a valid Integrity response alone is not evidence of an untampered app.
Campaign scope and backend capabilities
ThreatFabric reports credential targeting spanning Indonesia, China, India, Mexico, Morocco, and Thailand, with specific replacements observed for eight Indonesian banking apps. The operation combines on‑device credential theft and live remote control with a backend able to manage campaigns and stolen data. That backend organizes device records, lock‑screen history, and financial profiles that include monthly income and a risk‑score field, giving operators granular views of victims and campaign performance.
The same research group noted the timing of the Hirudo disclosure: it arrived a little over a month after ThreatFabric published findings on StreamRat, another Android threat that used ads on Meta and TikTok to target Spanish‑speaking users and enabled near‑complete remote control of infected devices.
What this means for technologists, end users, and policymakers
- Technologists and security teams: must treat locally produced app signals — signing certificate checks, accessibility lists, and integrity verdicts — as potentially attacker‑influenced and verify them server‑side, as ThreatFabric recommends.
- End users and the general public: face a higher‑sophistication lure: droppers that present real content and fake in‑app updates. Hirudo installs as a second app and requires separate permissions, so unexpected update prompts or new apps requesting accessibility and notification access are a specific red flag.
- Policymakers and platform operators: will need to consider how to constrain distribution channels used by droppers and fake store pages, including the ad flows on social platforms that ThreatFabric links to these campaigns, while reinforcing mechanisms that can detect relayed or re‑signed attestation flows.
Hirudo’s defining move is to shift the battleground from the device perimeter into the application itself — substituting a reused engine inside near‑identical app copies so that a genuine app’s internal checks can be fed attacker‑controlled responses. As ThreatFabric puts it: "Once an app can be replaced, its locally produced signals, signature, accessibility list, and integrity verdict, must be treated as attacker‑influenced and verified server‑side."
Source: https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html
