Hirudo Android banking RAT replaces genuine Indonesian banking apps with modified copies that spoof integrity checks

Linha do tempo

1. gbhackers.com ↗ · pub. 22/10/2026 07:16 · coletado 22/10 08:00 primeiro registro

   Hirudo Android banking RAT replaces genuine Indonesian banking apps with modified copies that spoof integrity checks

   ler a análise desta fonte ocultar

   ThreatFabric has documented Hirudo, an Android banking remote-access trojan that steals credentials and gives operators remote control of the phone. Its distinguishing feature is replacing selected genuine banking apps with modified copies that interfere with security checks from inside the app. Victims first install a lure app (Shopora, 1V1 X, ZoyaTV, KoiShort), which shows a fake in-app update to deliver the separate Hirudo payload. ThreatFabric found dedicated replacement packages for eight Indonesian banking apps across seven banks, and backend data from August 2026 held thousands of credential and device records.

   Technical Details

   • Two-app model: the lure acts as a dropper. The payload then requests Accessibility and notification access, enabling theft of banking credentials, payment PINs, device-unlock secrets and SMS, plus screen viewing over WebRTC and camera access.
   • Hirudo keeps a registry of 42 financial apps. When it detects a supported app, it shows a fake update prompt, opens Android's uninstaller for the genuine app and downloads a modified version.
   • The replacement keeps the original package name and version but is signed with a public Android test key, so the genuine app must be uninstalled first. This step depends on the victim and can be interrupted.
   • The modified app loads a hooking engine built on the open-source YAHFA and Dobby frameworks. It can falsify the signing certificate, hide enabled Accessibility services, remove FLAG_SECURE and tamper with key-attestation and Play Integrity checks.
   • Hirudo can also overlay a transparent fake checkout on a lure app, capture the payment PIN and return a forged success message.
   • A bundled attestation keybox was publicly leaked, and at least two certificates appear on Google's revocation list.
   • Lures are distributed via Amazon CloudFront, with campaign tracking tied to OpenInstall and Meta Pixel identifiers. An exposed APK-processing panel was used to build the lure and replacement apps. Some download routes were still live in September and October 2026.
   • Indonesia is the focus of the known replacements, but the code names credential targets in China, India, Mexico, Morocco and Thailand. The fake checkout also carries Malaysian bank and wallet branding.

   Remediation

   • Banks should verify Play Integrity verdicts server-side, bind verdicts to sessions and protected actions, and check attestation revocation. Revocation checks can expose forgeries built on the leaked keybox.
   • Keep transaction-risk controls for logins, beneficiary changes and payments. Use Accessibility and screen-capture indicators as inputs to broader risk scoring, not as stand-alone safeguards.
   • Users should avoid installing APKs from outside trusted app stores, be wary of in-app update prompts in shopping or entertainment apps, and refuse requests for Accessibility access or to remove a banking app. If a banking app disappears or is replaced, do not sign in and contact the bank through a verified channel.