In the ever-evolving arms race between cybercriminals and financial institutions, a dangerous new player has emerged. Security researchers at ThreatFabric have uncovered "Hirudo," a sophisticated Android banking trojan that represents a significant tactical shift in how malware compromises mobile financial services. Unlike traditional banking trojans that rely on "overlay attacks"—the practice of superimposing a fake login screen over a legitimate application—Hirudo opts for a more surgical and invasive approach: it replaces the genuine banking application with a tampered, malicious clone.

This strategy allows the malware to disable security mechanisms from within the application’s own code, effectively blinding the bank’s security measures to the malicious activity occurring on the victim’s device.

Main Facts: The Anatomy of a Replacement Attack

Hirudo operates through a meticulously crafted infection chain. The malware is distributed via "droppers"—applications disguised as benign shopping portals, streaming services, or adult content platforms. These droppers utilize legitimate-looking WebView interfaces to maintain a veneer of authenticity.

Once the dropper gains a foothold on a device, it scans for the presence of specific banking applications. If a target app is found, the trojan triggers an in-app update prompt. When the user interacts with this prompt, the malware silently initiates the uninstallation of the genuine banking application and, in parallel, downloads and installs a modified version.

This "patched" version retains the package name and version number of the original, making it indistinguishable from the legitimate app to the average user. However, the internal architecture has been subverted. The attacker injects a small, malicious code snippet into the application’s Application class. This snippet activates a hooking engine upon launch, utilizing open-source frameworks such as YAHFA and Dobby to intercept and modify both Java and native function calls.

The result is a "Trojanized" banking app that lies to the server. When the app performs internal security checks—such as verifying the app’s signing certificate or checking for unauthorized accessibility services—the hooking engine intercepts the request and provides fabricated, "clean" results. This allows the attacker to bypass Play Integrity checks and remain undetected while siphoning credentials and performing unauthorized transactions.

Chronology of the Operation

The discovery of Hirudo follows a period of intense activity throughout late 2026. While the malware’s capabilities were identified by researchers, the operational history suggests a highly organized campaign:

• August 2026: ThreatFabric analysts observed a surge in credential-harvesting activity linked to the Hirudo infrastructure. During this time, the attackers maintained a comprehensive database of victims, categorized by campaign groups and financial risk profiles.
• September 2026: The campaign reached peak maturity. Attackers utilized sophisticated infrastructure, including Amazon CloudFront for content delivery, OpenInstall for attribution, and Meta Pixel IDs for tracking, indicating a highly professionalized marketing and distribution funnel.
• Late September to October 2026: Despite the exposure of their infrastructure, several download routes remained active. Researchers discovered that the attackers’ "build server"—an automated panel responsible for compiling the droppers and patching the banking apps—had been left entirely unauthenticated, with sensitive cloud storage buckets and credentials exposed to the public.
• Post-Discovery (October 2026 onwards): Security researchers began the process of mapping the full extent of the botnet, identifying that at least eight Indonesian banking applications across seven distinct banks had already been targeted with custom-patched replacements.

Supporting Data and Technical Sophistication

The technical ingenuity behind Hirudo lies in its ability to manipulate the environment from the inside out. The use of a "trigger file" ensures that the malicious hooking engine remains dormant until instructed otherwise, helping the malware evade static analysis during initial security scans.

The Play Integrity Deception

One of the most alarming aspects of Hirudo is its approach to Google’s Play Integrity API. The malware does not merely try to bypass this check; it subverts the communication channel entirely. The banking app’s integrity requests are intercepted and redirected to a server controlled by the attacker via plain HTTP. The attacker’s server then provides a "correct" response, effectively spoofing a clean integrity report. ThreatFabric noted that the "keybox" used for these attestations had been publicly leaked, and several certificates were already flagged on Google’s revocation list—a testament to the cat-and-mouse nature of modern mobile security.

Targeted Regions and Scope

While the current list of specifically targeted applications focuses on Indonesia, the trojan’s reach is global. Its credential-stealing capabilities have been observed in:

• Indonesia (Primary focus for app replacement)
• China
• India
• Mexico
• Morocco
• Thailand

The malware maintains a registry of 42 financial applications, suggesting that the threat actors have the capability to quickly expand their "patching" operations to other regions and banks as needed.

Official Responses and Defensive Implications

The discovery of Hirudo has sent shockwaves through the cybersecurity community, particularly regarding the reliance on client-side security signals.

The Shift in Defensive Strategy

ThreatFabric’s report issues a stark warning to financial institutions: Client-side signals can no longer be trusted.

"Once an app can be replaced, its locally produced signals—signature, accessibility list, integrity verdict—must be treated as attacker-influenced and verified server-side," the researchers stated.

Banks that rely on client-side blockers—such as preventing an app from running if it detects a screen-recorder or if it detects an invalid signature—are effectively defenseless against an attacker who controls the application’s code. If the app is patched, it will simply report back to the bank’s backend that everything is "normal."

Recommendations for Financial Institutions

1. Server-Side Risk Scoring: Banks must move away from relying solely on the device’s self-reporting. Behavioral analysis, device fingerprinting, and transactional anomaly detection should be processed on the bank’s secure servers.
2. Attestation Validation: Rather than relying on standard Play Integrity responses, banks should implement more robust, multi-layered attestation processes that verify the integrity of the communication channel itself.
3. Application Hardening: While Hirudo proves that even hardened apps can be patched, implementing more rigorous code obfuscation and anti-tampering mechanisms (like those provided by advanced RASP solutions) can increase the effort required for attackers to build a functional replacement.

Implications: The Future of Mobile Banking Security

The Hirudo trojan represents a "deliberate escalation" in the war for mobile financial security. By moving the point of compromise inside the target application, the attackers have effectively nullified the traditional security architecture that most mobile banking apps rely upon.

The operational failure of the attackers—leaving their build server and cloud credentials exposed—was a stroke of luck for the research community. Had they secured their infrastructure, the scale of this campaign might have remained hidden for much longer.

The broader implication is clear: the era of assuming the mobile device is a "trusted environment" is over. As malware becomes increasingly capable of modifying the very software intended to protect the user, financial institutions must accept that the "client" is an inherently hostile environment. The battleground has shifted from the device to the server, and the security of the future will be defined by how well banks can identify fraud without relying on the integrity of the device itself.

As the industry moves forward, the "Hirudo model" of patching and hooking is likely to be adopted by other cybercriminal syndicates. The ability to create a reusable engine for tampering means that once a bank’s security logic is reverse-engineered, the entire institution is effectively compromised. The defensive response must therefore be equally agile, focusing on behavioral analytics and server-side verification as the final line of defense against an enemy that is already operating from within the walls.