Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

Hirudo is an Android RAT that installs via a dropper hidden in seemingly legitimate apps. It detects installed Indonesian banking apps, prompts users with fake update messages, uninstalls the genuine app, and installs a trojanized replacement. This replacement app includes a hooking engine that intercepts and falsifies app integrity checks such as signature verification, Accessibility service queries, screen capture, and Play Integrity checks. The RAT provides live remote control via WebRTC, including screen viewing and camera access, and collects SMS messages from targeted banks and wallets. Internal code suggests potential targeting expansion to banks in China, India, Mexico, Morocco, and Thailand. The malware represents an escalation in Android banking trojans by embedding tampering within the app itself, making local app signals untrustworthy.

Hirudo enables attackers to steal banking credentials, remotely control infected devices in real time, view live screens and camera feeds, and collect SMS messages, including those related to banking and wallet transactions. By replacing legitimate banking apps with trojanized versions that bypass internal integrity checks, it undermines app-level security controls. This can lead to unauthorized financial transactions and compromise of sensitive user data. The malware's ability to hide its presence from Accessibility and Play Integrity checks complicates detection and mitigation efforts.

No official patch or fix is available as this is malware rather than a software vulnerability. Financial institutions should enforce Play Integrity verification server-side and not rely solely on local app signals. Layered defenses incorporating behavioral analytics are recommended to detect fraudulent activity or suspicious lack of behavioral data. Accessibility and screen-capture signals should be used as supporting evidence in risk scoring rather than sole blocking criteria. Backend transaction risk controls at login, credential recovery, beneficiary creation, and payment approval must be retained to prevent unauthorized transactions. Users should avoid installing apps from untrusted sources and be cautious of fake update prompts.