Hirudo Android malware replaces banking apps to evade security checks

Hirudo Android malware operates by replacing legitimate banking applications on infected devices with modified versions that have disabled security checks. This manipulation allows the malware to capture bank account credentials from users without triggering the usual security alerts or protections embedded in the original apps. No detailed technical indicators or affected versions are provided.

The malware compromises the confidentiality of banking credentials by intercepting user input through tampered banking apps. This can lead to unauthorized access to victims' bank accounts and potential financial loss. There is no information about active exploitation in the wild or specific targeted regions.

No vendor advisory or patch information is available. Users should avoid installing apps from untrusted sources and verify the integrity of banking apps regularly. Security solutions that detect app tampering or unauthorized app replacements may help mitigate risk. Patch status is not yet confirmed — check vendor advisories for updates.