A newly discovered Android malware, identified as Hirudo, employs a unique strategy to commit financial fraud. Instead of just displaying fake login screens, this Trojan attempts to delete a user’s legitimate banking app and install a malicious version in its place. This replacement retains the original app’s name and version number but includes additional harmful code.
How Hirudo Operates
Hirudo’s operators use a method that combines app substitution with credential theft and remote access to infected devices. This allows them to gather banking passwords, payment credentials, SMS messages, and phone unlock details. Furthermore, they gain the ability to view the screen and access the device’s cameras, transforming Hirudo into a powerful remote access Trojan (RAT).
Analysts from ThreatFabric have identified that Hirudo has targeted eight Indonesian banking apps across seven banks. The malware’s adaptable system suggests its potential for broader targeting beyond these banks, posing a significant threat to a wide range of financial applications.
Distribution and Deception Tactics
Hirudo is distributed through seemingly harmless shopping and entertainment apps, such as Shopora and ZoyaTV. These lures often present legitimate-looking content, like storefronts or video catalogs, while secretly checking if the Hirudo payload is already installed on the device.
If the payload is absent, users are prompted with a fake update request to install another app package. This secondary app carries the Trojan, requiring specific permissions to activate its theft and control functions. This two-step installation process helps disguise the malicious intent, making the initial download appear less suspicious.
Threat to Banking App Integrity
Once activated, Hirudo leverages Android’s Accessibility service to detect targeted banking apps. It then triggers a false update alert, leading to the uninstallation of the legitimate app and the installation of a fraudulent replacement. This replacement uses the same package name and version but lacks the bank’s signature, instead using a public test key.
Hirudo’s design allows it to alter how apps respond to security checks, making it possible to disguise its presence and control over the device. The potential for banks to have their apps manipulated by such malware underscores the importance of server-side integrity checks and cautious user behavior.
Users are advised to be vigilant when an app requests an update outside official app stores, particularly if it seeks extensive permissions. If an unfamiliar app demands control over a device or a banking app vanishes unexpectedly, it’s crucial to contact the bank directly and verify the device’s safety from a trusted source.
By enhancing security measures and monitoring sensitive transactions, banks can mitigate the risks posed by such advanced threats. It’s vital for both users and institutions to stay informed and proactive in defending against evolving cyber threats like Hirudo.
