A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
Researchers identified malicious copies of eight banking apps that use a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists.
Threat actors can use Hirudo to steal credentials, remotely control infected phones in real time, collect messages, capture screenshots, and record audio.
A report today from mobile security company ThreatFabric notes that Hirudo has been observed impersonating at least seven Indonesian banks, but the malware also targets financial organizations in China, India, Mexico, Morocco, and Thailand.
The malware is typically delivered via apps for shopping (Shopora), adult content (1V1 X), or short drama (ZoyaTV, KoiShort) that appear legitimate and provide the promised functionality.
The researchers say that these apps act as malware loaders for Hirudo, showing a fake “update” notification that leads to permission-granting prompts, including for Accessibility services