As reported by BleepingComputer, a new Android banking malware dubbed Hirudo is replacing legitimate banking applications with trojanized copies that disable security checks from within the app's own process — a significant escalation in mobile banking fraud tactics.
Why Hirudo Demands Attention
Most Android banking trojans rely on accessibility-service-driven overlay attacks — slapping a fake login screen on top of a legitimate app. Hirudo takes a fundamentally different and more dangerous approach. It uninstalls the genuine banking app, downloads a patched replica that retains nearly all original code, and injects a hooking engine built on the open-source YAHFA and Dobby frameworks. The malware then operates inside the banking app's own process space, turning the app's own defenses against it.
This in-process hooking means conventional client-side security checks — signature verification, accessibility service detection, screenshot protection, and Google Play Integrity attestations — are all intercepted and spoofed before they can report anything amiss. The app believes it is legitimate. The device believes the app is legitimate. Only server-side validation can catch the deception.
Attack Chain Summary
| Stage | Technique | Indicator |
|---|---|---|
| Delivery | Malicious apps (Shopora, 1V1 X, ZoyaTV, KoiShort) posing as shopping, adult content, or streaming apps | App installed from outside Google Play; requests Accessibility permissions shortly after launch |
| Persistence | Uninstalls legitimate banking app, installs patched copy via Accessibility services | Unexpected uninstall/install activity; banking app reinstalled without user action |
| Evasion | YAHFA + Dobby hooking engine intercepts signature, attestation, and accessibility checks | App passes local integrity checks despite being modified |
| Exfiltration | Steals credentials, PINs, SMS; streams screen; accesses cameras; remote control | Unusual network traffic to C2; background audio recording; unexpected camera access |
Who Is at Risk
The Critical Weakness in Hirudo's Design
The bundled attestation keybox used by Hirudo has been publicly leaked, and Google has already listed two of its certificates as compromised. Server-side revocation checks can detect these forgeries — making server-side validation the single most effective detection control available right now.
This is the key takeaway for financial institutions: client-side checks are necessary but insufficient. If your fraud detection ends at the device, you are blind to this attack. Server-side certificate revocation checking against Google's compromised keybox list, combined with device intelligence and behavioral analytics, is what will catch Hirudo infections.
Shield53 Recommendations
For Financial Institutions
- Implement server-side Play Integrity verification: Do not trust attestation results reported by the client. Validate the attestation token server-side against Google's revocation lists and check for known compromised keyboxes.
- Deploy behavioral biometrics: Hirudo's remote control and screen streaming create anomalous interaction patterns — inconsistent touch pressure, unnatural navigation speed, irregular session timing — that behavioral analytics can flag even when the app appears legitimate.
- Enforce app-sideloading risk scoring: Flag sessions from devices with recently installed apps from unknown sources, especially when combined with recently reinstalled banking apps.
- Monitor for compromised certificate fingerprints: Maintain a denylist of known-compromised attestation certificates and reject sessions that present them.
For Mobile Device Administrators and MDM/MTD Programs
- Block sideloaded app installation: Enforce Google Play as the only app source via MDM policy. Hirudo's loader apps are not distributed through Play.
- Deploy Mobile Threat Defense (MTD) solutions: Look for MTD vendors that detect Accessibility service abuse and monitor for unexpected app reinstalls of financial applications.
- Alert on Accessibility service enrollment: Any non-assistive app requesting Accessibility services should trigger an immediate investigation. This is the single most abused Android permission in banking malware.
- Educate users on the "update" social engineering pattern: Hirudo lures victims with fake update notifications from seemingly unrelated apps. Train users to install updates only through the Play Store.
For Individual Users in Affected Regions
- Install apps only from Google Play. Do not sideload shopping, streaming, or adult content apps.
- Review which apps have Accessibility permissions and revoke access from anything that is not an explicitly trusted assistive tool.
- If your banking app unexpectedly uninstalls and reinstalls itself, contact your bank immediately from a different device.
Broader Implications
Hirudo validates a trend we have been tracking: mobile malware authors are moving from overlay-based attacks to process-hijacking attacks that are far harder to detect. The use of legitimate open-source hooking frameworks like YAHFA and Dobby lowers the barrier to entry for sophisticated attacks. We expect to see this technique proliferate beyond banking to crypto wallets, payment apps, and enterprise authentication tools within the next 12 months.
The defense shift is clear: the security boundary must move server-side. Any mobile application that relies on self-attestation is operating on borrowed time.
