Android Trojan ‘Hirudo’ Replaces Banking Apps with Fakes
Security analysts have identified a new Android banking trojan named Hirudo that attacks users by replacing legitimate banking applications with counterfeit versions. Initially observed targeting eight Indonesian banks, this malware carries the potential to expand its reach globally by adapting to include other regions and financial institutions.
How Hirudo Operates
Hirudo spreads primarily through deceptive dropper applications, which are often promoted on social media platforms. These dropper apps masquerade as harmless programs such as shopping, adult video, or short video drama apps to entice users into installing them.
Once installed, the dropper checks if Hirudo is already on the device and, if absent, downloads the trojan. The malware proceeds to identify any supported banking apps on the victim’s phone, then tricks users by presenting a fake update notification. When the victim accepts, Hirudo uninstalls the authentic app and substitutes it with a malicious copy designed to capture sensitive information.
Advanced Features and Risks
The counterfeit banking applications are engineered with a sophisticated hooking mechanism capable of evading multiple security checks. For instance, it can fake legitimate app certificates during authentication and conceal any active Accessibility service usage. Moreover, the trojan blocks screen capture attempts and bypasses Google Play Integrity verification.
Beyond credential theft, Hirudo grants attackers live access to the user’s screen via WebRTC and remotely activates the front and back cameras. It also harvests SMS messages, including up to 90 days of past communications, specifically targeting messages from banking and digital wallet providers.
Implications for Pakistan and Users
The discovery of Hirudo underlines a significant escalation in the complexity and effectiveness of Android banking malware. ThreatFabric researchers caution that the trojan’s modular hooking engine allows rapid adaptation to apps in various countries, with internal code references pointing to potential targets in China, India, Mexico, Morocco, and Thailand.
For Pakistani users, vigilance is critical due to increasing digital banking reliance and emerging cyber threats. To minimize risk, users should avoid installing apps from outside Google Play Store and be wary of apps promoted via social media advertisements.
Banks are urged to strengthen their defenses by implementing stringent server-side verification of Play Integrity checks, integrating behavioral analytics, and adopting advanced risk assessment approaches that utilize accessibility and screen-capturing signals rather than relying solely on blocking techniques.
As cybercriminals evolve their tactics, understanding and preempting such sophisticated malware like Hirudo becomes essential to safeguarding personal and financial data in Pakistan’s growing digital landscape.
