Hirudo: It Doesn't Overlay the Banking App Anymore — It Replaces It

Summary

Hirudo is a new Android banking RAT published by ThreatFabric on 14/10/2026, combining on-device credential theft with live remote control of the same phone.

Most Android bankers stop at the overlay: a fake screen drawn on top of the genuine banking app. Hirudo goes a step further. It uninstalls the genuine banking app and installs a patched copy, one that embeds a hooking engine which disables the bank's own security checks from inside that app's own process.

Purpose-built replacements currently exist for 8 Indonesian banking apps across 7 banks. But the RAT's registry lists 42 financial apps, and its credential targets span China, India, Mexico, Morocco and Thailand.

Priority actions:

• For banks and financial institutions: verify Play Integrity server-side, bound to the session and the protected action, and check attestation revocation. A valid verdict is no longer evidence that the app is untampered.
• For users and security teams: treat any "app update" prompt that appears inside another app as an attack, and be especially alert when something asks to uninstall a banking app.

A Two-Stage Design: Dropper and Payload

The app the victim installs first is a dropper, wrapped in a lure that actually works:

• Shopora — a shopping app
• 1V1 X — an adult-video app
• ZoyaTV and KoiShort — short-drama apps

These load real content in a WebView — a storefront, a video catalogue — so the experience looks entirely legitimate.

Behind that content, the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches its campaign configuration, then checks whether the payload (the Hirudo RAT) is already installed with its Accessibility service and notification access enabled.

If the payload is absent, the dropper shows a fake in-app "update" prompt and offers the bundled APK. The payload installs as a second app and must be granted its own permissions before any collection or control feature runs.

One analysed shopping dropper goes further: it raises a blackhole VPN that cuts the device's IPv4 traffic while the payload is installed. ThreatFabric notes this technique is currently seen across multiple active malware families.

Replacing the Banking App: Mechanism and Limits

This is what makes Hirudo notable. The process has four steps:

1. Detect the installed banking app through Accessibility.
2. Check its signing certificate against a stored reference, confirming it is the genuine build.
3. Show a fake "update" prompt, then open Android's uninstaller without waiting for the user to tap, while downloading the bank-specific replacement in parallel.
4. Drive the installer through Accessibility to install the patched build.

And here is the technique's real constraint. The replacement keeps the original package name and version but is signed with a public Android test key, not the bank's key. Android therefore refuses to install it as an update over the bank-signed app — which is exactly why Hirudo must remove the original first.

So the chain needs two things: the genuine app uninstalled, and the installer authorised. The victim can interrupt at both points. The paradox is that the stronger technique is more fragile in execution than a plain overlay.

The Hooking Engine: Disabling Defences From Within

ThreatFabric reverse-engineered one of the patched builds and found something striking: the bank's own code is left almost untouched. A single line is injected into the app's Application class. At launch, that line loads a self-contained hooking engine from bundled asset files.

The engine is built on two well-known open-source frameworks:

• YAHFA — replaces Java methods
• Dobby — hooks native functions

And it arms its hooks only when a shared trigger file written by the RAT is present on the device. A patched app sitting idle without the RAT therefore reveals little under analysis.

With the engine running inside the banking app's own process, the app's defences are turned against it:

What the banking app checks	What the patched build returns
Asking Android for its own signing certificate	The genuine bank certificate, hiding the test-key signature
Querying enabled Accessibility services	An empty list, so the controlling service is invisible
The FLAG_SECURE screenshot-blocking flag	Stripped, allowing the banking screen to be viewed and recorded remotely
Key-attestation certificates	Re-signed with a bundled keybox
Play Integrity requests	Relayed over plain HTTP to an operator-controlled server, which returns a verdict for the app to accept

Two Details Worth Underlining for Defenders

First, the bundled attestation keybox is not the operators' own. It is a publicly leaked keybox, and ThreatFabric confirmed at least two of its certificates appear on Google's attestation revocation list, marked as compromised. Which means a backend that checks revocation can still catch these forgeries.

Second, because the Integrity request is relayed rather than actually produced on the device, a valid Integrity response alone is not evidence of an untampered app.

Both point to the same conclusion: once an app can be replaced, every locally produced signal — signature, Accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.

The Other Theft Surfaces

Fake checkout. When the dropper's content triggers a payment, it passes the order details to the payload through an Android intent. The payload renders a fake checkout page in a transparent WebView positioned over the dropper's order screen. The page is branded with the bank or wallet the dropper supplies and localised into eight languages. The victim types a payment PIN, the payload uploads it as appPayPwd, then returns a forged payment-success result so the transaction appears to complete.

Login passwords. Separately from checkout, the payload uses bank- and wallet-specific prompts to request login passwords, uploaded as appPwd. It also reads the genuine app's screen to reflect the right user ID or amount back to the victim, making the prompt more convincing.

Device-unlock secrets. A full-screen fake pattern overlay captures the first pattern drawn, and in one build the payload reads PIN, password and pattern input directly from the phone's real lock screen through Accessibility.

The rest of the toolkit: live screen viewing over WebRTC, front- and rear-camera sessions, and SMS collection with a 90-day initial scan against a configured list of bank and wallet senders.

Distribution: Real Ad Infrastructure

Hirudo's lures are spread the way legitimate apps are.

Each lure is themed on content with broad appeal — football and other video, short dramas, shopping — and pointed at genuine or genuine-looking destinations such as the SparkShop Mall storefront and the KukuTV short-drama catalogue.

The APKs are served from Amazon CloudFront, across separate routes for the different lure families and a dedicated host for the eight patched banking apps. Notably, download checks through late September and into October 2026 showed some routes still live, with the casino-themed route still serving the same dropper recovered in August.

The campaign is stitched together with commodity attribution tooling: a page archived in June 2026 presented a Play Store-style install button for "1v1 vip", used OpenInstall for install attribution, and shared Meta Pixel IDs with short-drama records in Hirudo's backend, linking advertised branding directly to specific campaign groups.

Behind the lures sits an operator APK-processing panel reachable without a login, which rebuilds "shell" and payload APKs into finished lures and patched banking apps. Cloud-storage buckets and credentials were left exposed there too.

Targeting

The app replacement is specific to Indonesia: all eight patched apps belong to Indonesian banks. But Hirudo's configured scope is far broader than its replacement set:

• The RAT's registry holds 42 financial apps
• Credential targets span China, India, Mexico, Morocco and Thailand
• The bundled fake checkout carries Malaysian bank and wallet branding

ThreatFabric reads this layering as an operation that has industrialised one region while keeping the machinery portable. The replacement engine, the lure framework and the backend are not tied to any single bank, and country-named backend groups plus multi-country target lists indicate the same toolkit can be — and in places already is — pointed elsewhere.

The Back Office

Behind the phones sits a backend combining device control with credential, financial and campaign management.

Records captured in August 2026 included thousands of application-credential entries, split across short-drama and shopping campaign groups, alongside device records, lock-screen history, and financial profiles carrying monthly-income and risk-score fields.

The detail that says most about the operation's maturity: the operators annotate records they consider "phished" — a workflow built to turn stolen data into cash.

ThreatFabric could not determine the victim count.

Analysis

The contest has moved from the device to the application's own integrity. For years, bank-side defence revolved around "can this device be trusted": is it rooted, is there an unfamiliar Accessibility service, what does Play Integrity say. Hirudo answers all of those questions by taking over the answering. Once the engine runs inside the app's process, the app is no longer an honest observer.

The engine is reusable, so expansion is a cost problem, not a technical one. One line in the Application class; everything else lives in assets. Retargeting another bank requires the original APK and one rebuild — which the operators' own APK panel already automates.

The paradox: a stronger technique that is easier to interrupt. An overlay runs silently and asks nothing of the victim beyond typing into a fake screen. Hirudo has to uninstall the real banking app and reinstall from an outside source. Those are two points where an attentive user can stop the whole chain — and two points where awareness training has direct leverage.

The operators' infrastructure is sloppy in important places. An APK panel with no authentication, exposed buckets and credentials, a publicly leaked and already-revoked keybox, Play Integrity relayed over plain HTTP. For a group that invested in writing a hooking engine, these are surprising gaps — and exactly where defenders get leverage.

Publication did not end the campaign. CloudFront routes were still live into October, roughly two months after the dropper was collected in August. A familiar reminder: infrastructure riding legitimate CDN services is hard to take down.

Relevance to Vietnam

• Banking apps are the primary transaction channel in Vietnam. Every major bank has one, and that is where people move money — not the web.
• The defences Vietnamese banks rely on are exactly the ones Hirudo targets: root detection, unfamiliar Accessibility service detection, FLAG_SECURE screenshot blocking, and Play Integrity. If those checks run client-side and their results are trusted, they carry no weight against a replaced app.
• Sideloading APKs is still common, and "update your app" lures are already familiar to Vietnamese users from repeated campaigns impersonating government applications.
• Shopping and short-drama lures fit the local market. Short-drama apps and cheap shopping apps are heavily advertised on Vietnamese social media right now.
• Hirudo is not targeting Vietnam yet, but its machinery is portable, and neighbouring countries are already in the configured target list.

Recommendations

For banks and financial institutions

• Verify Play Integrity server-side, bound to the session and the protected action, and check attestation revocation. This is the control that actually catches Hirudo's forgeries, because the keybox it uses has been revoked.
• Treat Accessibility and screen-capture signals as supporting evidence, not blockers. A patched app can hide its own Accessibility service and strip FLAG_SECURE, so these checks should feed risk scoring rather than stand alone.
• Add a behavioural analytics layer. ThreatFabric makes a sharp point here: even if malware blocks behavioural data collection, the absence of that data is itself a suspicious indicator.
• Retain backend transaction-risk controls at login, credential recovery, beneficiary creation and payment approval — the points where a forged local result cannot substitute for a server-side decision.
• Monitor app uninstall-and-reinstall events. An account whose app was just removed and reinstalled from a non-Play-Store source, immediately before an unusual transaction, is a high-risk pattern worth scoring.

For users and enterprise security teams

• Never install an app update from inside another app. Banking apps update through the Play Store. An "update" prompt appearing inside a shopping or video app is an attack, with no exceptions.
• Stop immediately if something asks to uninstall a banking app. This is a mandatory step for Hirudo and the most recognisable point in the whole chain.
• Audit Accessibility permissions regularly on personal and BYOD devices that reach corporate resources. An app holding both Accessibility and notification access without a clear reason is a combination worth investigating.
• Block sideloading on corporate devices via MDM, keep Play Protect enabled, and for BYOD at minimum alert on installs from unknown sources.
• Load the indicators below into monitoring, noting that the CloudFront hosts are shared legitimate infrastructure, so block at path level rather than blocking the domain.

IOCs

Per ThreatFabric's publication of 14/10/2026.

Malware samples (SHA-256)

f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248
  com.agbbh.kjdrttt        # shopping lure + dropper

0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7
  com.onev.vip             # 1v1 vip lure + dropper

2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b
  com.koishort.app         # KoiShort lure + dropper (casino route)

d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
  com.zoyatv.app           # ZoyaTV lure + dropper

425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83
  com.zk7qpx.mv9wlt        # Hirudo RAT (July build)

b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99
  com.r9nkvx.qw2mpl        # Hirudo RAT (v7.8.166)

Command infrastructure

www[.]helloharmonyos[.]com           # lure registration and channel configuration
jiekou[.]baojingtextile[.]cn         # RAT configuration API
134[.]122[.]153[.]136:8085, :18085   # HTTP API endpoints
134[.]122[.]153[.]136:1883, :1884    # MQTT broker

Play Integrity relay

hxxp://43[.]225[.]157[.]157:8766/request_token    # used in 4 patched apps

CloudFront delivery routes

d3s06yhcwfnwcx[.]cloudfront[.]net/apk-fortress/latest.apk   # 1V1 X
d21gcldn8gp80l[.]cloudfront[.]net                           # KoiShort (casino)
dydjjnnjg7jeb[.]cloudfront[.]net                            # KoiShort (short drama)
d3q4tlm7pw29zr[.]cloudfront[.]net                           # the 8 patched banking apps

APK build and management infrastructure

134[.]122[.]153[.]68:8080     # APK-processing panel
134[.]122[.]153[.]92:8080     # APK-processing panel
18[.]139[.]79[.]161           # APK source host and app-management console

On-device indicators

An app holding both Accessibility and notification access with no clear reason
A banking app uninstalled and reinstalled from a non-Play-Store source
A banking app signed with the public Android test key instead of the bank's key
A VPN raised immediately before or during the installation of another app
C2 field names: appPayPwd (payment PIN), appPwd (login password)

References

• ThreatFabric — Hirudo: From Fake Updates to Patched Banking Apps (14/10/2026): https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps
• BleepingComputer (Bill Toulas) — Hirudo Android malware replaces banking apps to evade security checks (14/10/2026): https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/