// AI threat desk · 16 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumRATCVSS not assigned

Hirudo Android banking RAT replaces apps to enable credential theft

ThreatFabric identified Hirudo, an Android banking RAT that replaces targeted apps with modified copies and enables credential theft and device control.

· 3 min read
AI-generated image of an Android phone and laptop undergoing mobile security analysis at a dim workstation.
AI-generated image, not a photo of the event.
Key takeaways
  • Hirudo replaces genuine banking apps with modified copies that disable security checks from inside the apps.
  • Eight Indonesian banking apps across seven banks have purpose-built replacements containing a hooking engine.
  • ThreatFabric found thousands of credential and device records, lock-screen history and financial profiles in records captured in August 2026.

ThreatFabric has identified Hirudo, an Android banking remote access trojan that combines on-device credential theft with live remote control of the same phone.

Hirudo attempts to replace genuine banking apps with modified copies that disable security checks from inside the apps. ThreatFabric identified purpose-built replacements for eight Indonesian banking apps across seven banks, with an engine designed to blind signature, Accessibility, screen-capture and Play Integrity checks.

The malware is delivered as a separate APK through shopping, adult-video or short-drama lure apps that present a fake in-app update. Its credential targets span Indonesia, China, India, Mexico, Morocco and Thailand, while its code keeps a registry of 42 financial apps.

On this page

Hirudo removes the genuine app and installs a bank-specific replacement

ThreatFabric said Hirudo opens Android’s uninstaller for the genuine banking app without waiting for the user to tap, while downloading the bank-specific replacement in parallel. The replacement keeps the original package name and version number but uses a public test key instead of the bank’s certificate.

SecurityWeek reported that the remote-control functions include live screen viewing through WebRTC, remote camera access and remote interaction through Android Accessibility Services.

Hirudo lures users with convincing branded apps

ThreatFabric said the dropper loads real content through a WebView so the lure appears genuine, then carries Hirudo as a second app behind a fake update. The lures were served from Amazon CloudFront and linked to campaigns through OpenInstall attribution and Meta Pixel IDs.

The operator’s APK-processing panel, which rebuilt droppers and patched banking apps into finished lures, was reachable without authentication. ThreatFabric said the panel exposed cloud-storage buckets and credentials.

Hirudo records included credentials and financial profiles

ThreatFabric said records captured in August 2026 included thousands of application-credential entries divided between short-drama and shopping campaign groups, along with device records, lock-screen history and financial profiles containing monthly-income and risk-score fields.

ThreatFabric said operators annotated records they considered phished.

What happened

ThreatFabric advised financial institutions to verify and enforce Play Integrity server-side, bind it to the session and protected action, and check attestation revocation. It said Hirudo’s publicly leaked attestation keybox included at least two certificates on Google’s revocation list as compromised.

ThreatFabric said some malicious download routes remained live in October 2026. Checks through late September and into October found a casino-themed route serving the same dropper recovered in August.

The company said financial institutions should keep server-side transaction-risk controls for login, credential recovery, beneficiary creation and payment approval, where a forged local result cannot replace a server-side decision.

What to do now

  1. Verify and enforce Play Integrity server-side, bound to the session and the protected action, and check attestation revocation.
  2. Apply layered defences by adding behavioural analytics.
  3. Treat Accessibility and screen-capture signals as supporting evidence, not as blockers.

FAQ

What is Hirudo Android malware?

Hirudo is an Android banking remote access trojan that combines on-device credential theft with live remote control of the same phone.

How does Hirudo attack banking apps?

It attempts to replace a genuine banking app with a modified copy that disables the bank’s security checks from inside the app. Eight Indonesian banking apps across seven banks have purpose-built replacements.

Which countries does Hirudo target?

Credential targets named in Hirudo’s code span Indonesia, China, India, Mexico, Morocco and Thailand.

What can Hirudo control on an Android phone?

SecurityWeek reported live screen viewing through WebRTC, remote camera access and remote interaction through Android Accessibility Services.

Are Hirudo download routes still live?

ThreatFabric reported that some malicious download routes remained live in October 2026, including a casino-themed route serving the same dropper recovered in August.

Sources

  1. Hirudo: From Fake Updates to Patched Banking Apps, ThreatFabricPrimary
  2. Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks, The Hacker News
  3. Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies, SecurityWeek
  4. Study Finds Hirudo, Highly Dangerous Trojan that Replaces Banking Apps with Fake Ones, Nigerian CommunicationWeek
  5. [Security] New Android Banking Trojan 'Hirudo' Emerges: A Sophisticated Technique to Bypass Security Verification by 'Patching' Legitimate Banking Apps, note
How we checked this story
ClaimSourceStatus
ThreatFabric identified Hirudo as a new Android banking remote access trojan combining on-device credential theft with live remote control.ThreatFabricConfirmed
Hirudo attempts to replace genuine banking apps with modified copies that disable the banks’ security checks from inside the apps.ThreatFabricConfirmed
Eight Indonesian banking apps across seven banks have purpose-built replacements embedding a hooking engine to blind several security checks.ThreatFabricConfirmed
Hirudo is delivered as a separate APK carried by shopping, adult-video, or short-drama lure apps behind a fake in-app update.ThreatFabricConfirmed
Hirudo credential targeting spans Indonesia, China, India, Mexico, Morocco, and Thailand.ThreatFabricConfirmed
Hirudo keeps a registry of 42 financial apps, but only eight Indonesian apps across seven banks have dedicated replacement downloads.ThreatFabricConfirmed
ThreatFabric said hirudo opens Android’s uninstaller for the genuine banking app and downloads the bank-specific replacement in parallel.ThreatFabric, via The Hacker NewsAttributed
ThreatFabric said Hirudo’s publicly leaked attestation keybox includes at least two certificates on Google’s revocation list.ThreatFabricConfirmed
ThreatFabric said August 2026 records included thousands of credential and device records, lock-screen history, and financial profiles.ThreatFabricConfirmed
ThreatFabric reported that some malicious download routes remained live in October 2026.ThreatFabricConfirmed
SecurityWeek reported that Hirudo provides live screen viewing, remote camera access, and remote interaction through Android Accessibility Services.SecurityWeekAttributed
ThreatFabric advised retaining backend transaction-risk controls for login, credential recovery, beneficiary creation, and payment approval.ThreatFabricConfirmed
ThreatFabric published its Hirudo investigation on October 14, 2026, according to a secondary report.ThreatFabric, via noteAttributed
ThreatFabric said Hirudo attempts to replace banking apps with modified copies that disable security checks from inside the apps.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said eight Indonesian banking apps from seven banks already had specially designed replacements.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said hirudo is delivered as a second app hidden inside a convincing shopping, short-drama, or adult-video dropper.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said the dropper loads real content through a WebView to make it appear genuine.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said the replacement keeps the original package name and version number but is signed with a public test key.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said hirudo’s modified banking app uses YAHFA and Dobby to alter Java methods and hook native functions.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said the malicious lures were served from Amazon CloudFront and linked to campaigns through OpenInstall and Meta Pixel IDs.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said the operator’s APK-processing panel was reachable without authentication and exposed cloud-storage buckets and credentials.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said August 2026 records included thousands of credential entries split across campaign groups.ThreatFabric, via Nigerian CommunicationWeekAttributed
ThreatFabric said operators annotated records they considered phished.ThreatFabric, via Nigerian CommunicationWeekAttributed

Could not verify

  • Whether Hirudo has been used successfully against victims or financial institutions is not established
  • Whether the operation caused confirmed financial losses is not established
  • Whether the eight targeted Indonesian banking apps correspond to eight affected victims is not established
  • Whether Hirudo has a CVE assignment is not established
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok