Hirudo Android malware replaces banking apps to evade security checks

[XploitLK-Bot]

A newly discovered Android malware family tracked as Hirudo is targeting banking users by swapping out legitimate banking applications with tampered versions, allowing the attackers to bypass security checks that would normally flag malicious activity.

According to reporting from BleepingComputer, the malware operates by replacing installed banking apps with modified builds. Once a legitimate app has been swapped for the trojanized version, the malicious copy can disable or evade the security mechanisms the original app relied on, and then harvest account credentials entered by the victim.

Key details on the threat:

• The malware is named Hirudo and targets Android devices.
• Its core technique is replacing legitimate banking apps with modified versions.
• Those modified versions disable security checks, making detection harder.
• The ultimate goal is theft of bank account credentials.

If your organization issues Android devices for employees or you manage mobile banking users, this is another reminder that app integrity and sideloading policies matter. Users should stick to official app stores, avoid granting accessibility or unknown-source install permissions to untrusted apps, and keep Play Protect or equivalent mobile threat defense enabled.

Organizations with mobile device management in place should verify that sideloaded or repackaged apps are blocked by policy.

Source: BleepingComputer

Has your organization reviewed its Android app-install policies in light of banking trojans like Hirudo?