As reported by The Hacker News, ThreatFabric has uncovered an Android banking trojan dubbed Hirudo that employs a notably sophisticated infection chain: replacing legitimate banking applications with purpose-built patched versions designed to circumvent the apps' own security mechanisms. This is not merely another overlay trojan — it represents a structural evolution in how threat actors approach mobile financial fraud.
Why the Patched-App Approach Matters
Historically, Android banking trojans like BankBot, Anubis, and Octo relied on accessibility services to overlay fraudulent screens on top of legitimate apps, intercepting credentials at the UI layer. Hirudo's approach is fundamentally different. By distributing modified APKs that appear to be the genuine banking app, the threat actor controls the entire application stack — meaning any client-side security checks, certificate pinning, or anti-tampering controls baked into the original app are effectively neutralized or stripped out.
This shifts the threat model significantly. App-internal integrity checks — which many banking institutions treat as a reliable defensive layer — can no longer be assumed to be present once a user has accepted a replacement APK. The trojan doesn't need to bypass the bank's security; it is the bank's app, just a hostile version of it.
The Dropper Ecosystem and Evasion Techniques
Hirudo's delivery mechanism deserves attention. The identified dropper apps — Shopora, 1V1 X, KoiShort, and ZoyaTV — are functional lures that load real content, creating a credible user experience that reduces suspicion. This is a hallmark of mature threat operations that understand user psychology: a broken or empty app triggers immediate uninstall; a working one buys time for the payload to execute.
The VPN-based evasion technique — configuring a deliberately non-functional VPN connection to block cloud-based reputation checks — is particularly noteworthy. While ThreatFabric correctly notes this doesn't fully bypass Google Play Protect's offline detection, it demonstrates threat actors are actively adapting to Google's cloud-based analysis pipeline. We should expect this technique to proliferate across other malware families as a standard anti-analysis layer.
Geographic Targeting and Broader Implications
While eight Indonesian banking apps were identified as replacement targets, credential theft spans Indonesia, China, India, Mexico, Morocco, and Thailand. This multi-regional footprint suggests a financially motivated operation with either affiliate distribution or a single actor with broad infrastructure. Institutions in these regions — particularly those with rapidly growing mobile banking adoption but less mature app-distribution security postures — should consider themselves at elevated risk.
The broader implication is that app replacement as a technique will spread. If a trojan can successfully replace one bank's app, the same infrastructure can be repurposed for any institution where users can be socially engineered into installing a replacement. This is especially dangerous in markets where users routinely install apps from third-party stores or sideload APKs.
Shield53 Recommendations
The key takeaway for defenders: app-internal security can no longer be trusted as a sole control layer. The assumption that a banking app running on a device is the genuine banking app is exactly the assumption Hirudo is designed to break.
