Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

[XploitLK-Bot]

Researchers at ThreatFabric have disclosed a new Android banking trojan dubbed Hirudo that takes a different approach from typical overlay or accessibility-based malware. Instead of injecting fake screens on top of legitimate apps, Hirudo replaces genuine banking applications with purpose-built patched versions that disable the apps' own built-in security checks from the inside.

The Dutch mobile security firm found that the trojan targets the financial sector in Indonesia, with replacements identified for eight Indonesian banking applications. By running a modified version of the actual banking app, Hirudo can bypass protections that would normally detect tampering or hostile environments, making the fraud harder for both users and the banks' own defenses to spot.

This technique represents a notable escalation in financial fraud on Android, since the malicious app inherits the trust and functionality of the real one while the security mechanisms are stripped away.

Key points:

• Hirudo is an Android banking trojan analyzed by ThreatFabric.
• It swaps legitimate banking apps for patched versions that bypass the apps' internal security checks.
• Replacements were found for eight Indonesian banking applications.
• The approach differs from overlay-based trojans by operating from within a modified legitimate app.

Source: The Hacker News

Does your organization have controls in place to detect repackaged or tampered banking apps on user devices?