Security · Updated 14 Oct, 05:11 pm IST

Hirudo Android trojan replaces banking apps to bypass security checks

Why it matters for readers: This shows malware can replace real apps to bypass protections, so be careful with app updates and permissions.

Hirudo works by replacing legitimate banking apps with patched versions designed to bypass the apps' own security checks.1 2
ThreatFabric identified replacements for eight Indonesian banking apps and said credential targeting spans Indonesia, China, India, Mexico, Morocco and Thailand.1
The malware is delivered by shopping, adult video, and entertainment dropper apps that install the trojan as an in-app update.1
Hirudo combines credential theft, device takeover, screen and camera capture, and SMS interception with a mature backend for live remote control.1
Some identified dropper apps include Shopora, 1V1 X, KoiShort and ZoyaTV.1

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.

14 Oct, 04:38 pm · The Hacker News
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
14 Oct, 05:11 pm · BleepingComputer
Hirudo Android malware replaces banking apps to evade security checks