Hirudo swaps your real banking app for a patched copy that blinds its own security checks

On October 14, 2026, the mobile security firm ThreatFabric published its analysis of a new Android banking trojan it calls Hirudo. Most banking malware draws a fake login screen on top of your real banking app. Hirudo tries something bolder: it removes the real app and installs a modified copy that switches off the app’s own security checks from the inside. Right now it’s aimed at Indonesian banks, so most of our readers won’t meet it. The way it gets onto a phone is the part worth knowing, because it’s the same everywhere.

How it gets in

It starts with an app that works. ThreatFabric found Hirudo inside a shopping app (Shopora), an adult-video app (1V1 X) and short-drama apps (ZoyaTV and KoiShort), each showing real content. The researchers traced the downloads to links on Amazon’s CloudFront, promoted through ad campaigns. Once you’re using the app, it shows a fake in-app “update” that installs a second app: the trojan itself. That second app then asks for the Accessibility permission and access to your notifications. Without them, it can’t do much.

What it does to your banking app

Hirudo keeps a list of 42 financial apps. For eight Indonesian banking apps, covering seven banks, it has a ready-made replacement. When it sees one on your phone, it shows another fake update, opens Android’s uninstaller for the real app, downloads the patched copy and uses Accessibility to click through the install.

The patched copy keeps almost all of the bank’s own code. ThreatFabric found one injected line that loads a hooking engine, and that engine lies to the app about itself:

• when the app checks its own signature, it gets the genuine one back
• when it asks which Accessibility services are running, it gets an empty list
• the setting that blocks screenshots of the banking screen is removed, so the screen can be watched remotely
• Google’s Play Integrity check, which banks use to see whether an app has been tampered with, is relayed through the attackers’ server

What it steals

ThreatFabric says Hirudo collects banking passwords, payment PINs typed into a fake checkout page, your phone’s unlock PIN or pattern, and text messages, and it can stream your screen and use the front and rear cameras. The researchers found thousands of stolen credential entries in a backend the operators left exposed, though the number of victims is unknown, BleepingComputer reports. Beyond Indonesia, the code names targets in China, India, Mexico, Morocco and Thailand, and the fake checkout carries Malaysian bank branding.

Where it can be stopped

The swap has weak points. Because the copy isn’t signed with the bank’s key, Android won’t install it over the genuine app, so Hirudo has to get the real one uninstalled first. ThreatFabric notes you can interrupt that at two points: the uninstall and the install. The researchers also found that the key the malware uses to fake hardware attestation was leaked publicly, and Google has already listed two of its certificates as compromised, so a bank that checks for that on its own servers can catch it.

What to do

1. Update apps only through the Play Store. A shopping or video app that offers to install its own “update” is the warning sign here.
2. Keep “Install unknown apps” switched off for your browser and every other app.
3. Don’t grant Accessibility to anything that isn’t an accessibility tool you chose. It lets an app read your screen and tap for you. Our post on the Accessibility permission explains what to look for in Settings.
4. If your banking app asks to be reinstalled, or vanishes and comes back, stop. Reinstall it only from the Play Store, and call your bank using the number on your card.

Sources

• ThreatFabric, Hirudo: From Fake Updates to Patched Banking Apps, October 14, 2026
• BleepingComputer, Hirudo Android malware replaces banking apps to evade security checks, October 14, 2026
• SecurityWeek, Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies, October 15, 2026