Hirudo Android Trojan Bypasses Banking App Security via Patched Replacements

Cybersecurity researchers from the Dutch firm ThreatFabric have disclosed details of a new Android banking trojan called Hirudo. The malware operates by surreptitiously replacing legitimate banking applications on a victim's device with patched, counterfeit versions of those same apps.

According to ThreatFabric, these patched replacements are designed specifically to bypass built-in security checks from within the app itself. This approach marks a notable escalation in financial fraud techniques, as the malware leverages the trust users place in their legitimate banking software while circumventing the security mechanisms those apps employ.

The firm identified replacements for eight Indonesian banking applications. While the specific names of the targeted banks have not been publicly disclosed in full, the trojan's focus on the Indonesian market suggests a targeted campaign. The exact distribution mechanism for Hirudo is under investigation, but the implication is that users may download the trojan through unofficial channels or be tricked into installing it.

Once installed, the patched banking app appears functional to the user, potentially allowing the threat actor to intercept sensitive information, capture credentials, or facilitate unauthorized transactions. Security experts note that this technique blurs the line between a compromised device and a compromised application, making detection more challenging for both users and security software.

ThreatFabric has not assigned specific CVE identifiers to the issue, as the trojan primarily relies on replacing legitimate binaries rather than exploiting a specific software vulnerability in the traditional sense. Mitigation advice focuses on obtaining applications exclusively from official app stores, verifying app signatures, and remaining vigilant for unusual application behavior or unexpected requests for permissions.