Where most Android banking trojans simply overlay a bogus login screen on top of the real app, Hirudo is less subtle — the legitimate app is removed outright and an altered replacement takes its place.
ThreatFabric, which analyzed the code, calls Hirudo a hybrid: it steals credentials the way a conventional banking trojan does, yet it also ships the complete remote-control arsenal of a modern RAT. Live screen viewing over WebRTC is part of that kit, along with camera access and control via Android’s Accessibility Services.
A dropper hidden in content that appears routine — a shopping app, an adult video app, or a short drama app spread through social media — is how the malware arrives. After installation the dropper verifies whether Hirudo is already present, and only then does it deploy the payload.
The genuine trick unfolds when a victim launches a banking app the malware targets. Hirudo spots it, presents a fake update prompt, strips the real package off the device, and retrieves its own replacement tailored to that bank. A hooking engine embedded in that copy is built to blind signature verification, Accessibility queries, screen capture and Play Integrity checks.
According to the researchers, that hooking engine is what makes the code alarming. Android is handed the genuine certificate when the app requests its signing certificate, and the hook answers with an empty list when asked which Accessibility services are active, leaving the controller invisible.
Replacement builds already exist for eight Indonesian banking apps drawn from seven banks. Planned targets in China, India, Mexico, Morocco and Thailand are indicated by code buried inside the malware.
