Cybersecurity experts have unveiled details about a sophisticated Android banking trojan known as Hirudo. This malware operates by replacing authentic banking apps with modified versions that bypass internal security checks, signaling a new level of financial fraud. Dutch cybersecurity firm ThreatFabric discovered that the trojan targets eight Indonesian banking apps, with its credential-stealing operations extending to Indonesia, China, India, Mexico, Morocco, and Thailand.
Hirudo’s Advanced Fraud Techniques
Hirudo employs a combination of credential theft, device control, and screen and camera capture, supported by a robust backend infrastructure. ThreatFabric’s vice president of fraud engineering, Eward Driehuis, explained that the malware is distributed via apps related to shopping, adult videos, and entertainment. These apps act as droppers, carrying the trojan as a separate installation package, disguised as in-app updates.
The dropper apps, such as Shopora and 1V1 X, provide legitimate-looking content through WebViews, presenting as storefronts or video catalogs. However, they also execute a routine to install the Hirudo trojan, which requires specific permissions to function.
Bypassing Security with Patched Apps
Hirudo’s approach involves replacing genuine banking apps with tampered copies that include a hooking engine. This engine allows the malware to evade signature, accessibility, screen-capture, and Play Integrity checks. The trojan identifies the installed banking app using accessibility features and then prompts a fake update to facilitate the replacement.
The malware’s method involves removing the legitimate app before installing the altered version. Although this is a constraint, it effectively bypasses the app’s internal security by manipulating responses such as signing certificates and accessibility service queries.
Distribution and Impact on Users
The malware is spread through deceptive web pages mimicking Google Play Store landing pages for shopping and entertainment apps. Users are often directed to these pages via advertisements on Meta-owned platforms. The backend of the operation enables comprehensive device control and management of stolen data, including financial profiles and device records.
Hirudo’s strategy marks a significant shift in how Android banking trojans tackle secure applications. By embedding itself within the target app, the malware moves the challenge from the device level to the app’s integrity checks, utilizing a reusable engine that can be adapted for various apps and regions.
Looking Forward
The findings about Hirudo come shortly after revelations about StreamRat, another malware targeting Spanish-speaking users through deceptive ads on Meta and TikTok. StreamRat exploits accessibility services to gain extensive control over compromised devices, highlighting the escalating threat landscape for Android users.
As these threats evolve, cybersecurity experts emphasize the need for robust server-side verification to counteract the influence of such sophisticated malware. Users and developers alike must remain vigilant to safeguard against these increasingly complex attacks.
