Threats Tagged 'hirudo'
View all threats tagged with 'hirudo'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'hirudo'
Click on any threat for detailed analysis and mitigation recommendations
Hirudo is an Android banking remote access trojan that combines credential theft with live remote control capabilities. It is distributed via shopping and entertainment apps acting as droppers, which install the trojan behind fake update prompts. The malware replaces legitimate banking apps with patched versions that disable internal security checks. The campaign targets eight Indonesian banking apps covering seven banks, embedding a hooking engine in the replacements. Distribution uses legitimate advertising infrastructure including Amazon CloudFront. Targeting extends beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records. No CVE or official patch information is available. MediumMalware Join the discussion British Indian Ocean Territory China India+5#device takeover#indonesia targeting#android banking trojan | AlienVault OTX General | 10/14/2026, 13:35:47 UTC Added: 10/15/2026, 10:03:46 UTC |
Showing 1 to 1 of 1 result