As reported by SecurityAffairs, ThreatFabric has uncovered an Android banking trojan dubbed Hirudo that replaces genuine banking apps with modified copies rather than using the overlay techniques favored by most Android banking malware families. This is a meaningful evolution in mobile financial crime, and it deserves more attention than a typical "new trojan discovered" advisory.

Threat Alert: As reported by SecurityAffairs, ThreatFabric has uncovered an Android banking trojan dubbed Hirudo that replaces genuine banking apps with modified copies rather than using the overlay techniques favored by most Android banking malware families.

Why App Replacement Changes the Threat Model

Most Android banking trojan families — from Cerberus to Anatsa to Vultur — rely on overlay attacks: injecting a fraudulent login screen on top of the legitimate app and hoping the user doesn't notice. This approach has a fundamental weakness from the attacker's perspective: the genuine banking app is still running underneath, and its own anti-fraud and certificate-pinning mechanisms remain intact.

Hirudo's approach is structurally different. By uninstalling the real banking app and installing a trojanized copy, the attacker gains a clean environment where they control the entire application stack — the UI, network calls, certificate validation, and any client-side fraud checks the bank built in. This is closer to a supply-chain compromise than a traditional overlay scam, and it dramatically lowers the defender's ability to detect anomalous behavior server-side.

The shift from overlay-based credential theft to full app replacement effectively turns the bank's own security investment against the customer — the user trusts the app because it looks, feels, and behaves like the real one, because it once was.

The Broken VPN Trick Deserves Scrutiny

One of the more novel techniques ThreatFabric describes is the dropper creating a deliberately broken VPN connection during installation. The apparent goal is to sever the device's network connectivity temporarily, preventing Google Play Protect and other cloud-based reputation systems from querying the malicious APK in real time. While this doesn't fully bypass Play Protect, it highlights a growing attacker awareness of runtime reputation and cloud-based detection as a defensive layer — and a willingness to engineer around it.

Geographic and Sector Exposure

With 42 financial apps in its target registry and confirmed replacement packages for eight Indonesian banking apps across seven banks, Hirudo is currently concentrated in Southeast Asia. However, the target list also references users in China, India, Mexico, Morocco, and Thailand. Financial institutions in these regions should treat this as an early warning — Hirudo's modular target registry means new bank-specific replacement packages can be added quickly without rebuilding the core malware.

Shield53 Recommendations

Shield53 Recommendations
For financial institutions: Implement device-side integrity attestation that checks the installed app's signing certificate against a server-side whitelist at every authentication event — not just at login. App replacement succeeds because client-side checks can be bypassed in a modified APK.
For mobile security teams: Audit Android Accessibility Service usage in your environment. Hirudo requires Accessibility permissions to trigger the uninstall flow and detect target apps. Restricting or monitoring Accessibility enrollment is one of the highest-leverage mitigations available.
For Google Play Protect and MDM vendors: Treat sudden, user-uninitiated uninstall intents targeting financial apps as a high-confidence detection signal. The automatic uninstaller invocation described by ThreatFabric is a behavioral signature worth hunting for.
For end users in affected regions: Never install app updates from in-app prompts that redirect outside the official app store. Legitimate banking apps never ask you to sideload an APK. If an app asks for Accessibility permissions unexpectedly, treat it as a red flag.
For threat hunting teams: Search endpoint logs for the sequence of: new app installation from a non-Play source → Accessibility Service enrollment → uninstallation of a banking app package name. This behavioral chain is Hirudo's operational signature and likely to be reused by copycat malware.

Hirudo may be regionally focused today, but the app-replacement paradigm it demonstrates is exportable. We expect to see this technique adopted by higher-volume banking trojan families within 6–12 months, particularly those already operating with dropper infrastructure and Accessibility-based abuse. Defenders who treat this as an Indonesia-only problem will be unprepared when it arrives in their market.