A new remote access trojan (RAT) for Android, known as Hirudo, is raising alarms by compromising banking app security. This malware utilizes altered versions of legitimate banking applications to bypass internal security protocols.
Understanding the Hirudo RAT
Hirudo combines features of a traditional banking trojan with those of a comprehensive remote access tool. It functions by stealing credentials directly from the device while simultaneously enabling live remote operations. This capability includes real-time screen viewing through WebRTC, access to the device’s camera, and manipulation via Android Accessibility Services.
According to ThreatFabric’s analysis, Hirudo is distributed through a deceptive dropper embedded within seemingly legitimate applications. These apps, often advertised on social media, range from shopping platforms to adult content and drama apps. Upon installation, the dropper checks for the presence of Hirudo and installs it if absent.
Targeted Banking Applications
Currently, Hirudo primarily targets eight Indonesian banking applications, although its internal code suggests potential expansion to banks in China, India, Mexico, Morocco, and Thailand. The malware identifies the active Indonesian banking app on the device, prompts a fake update, and then replaces the genuine app with its modified version.
This variant includes a hooking engine that circumvents signature verifications, Accessibility, screen-capture, and Play Integrity checks. Researchers note that when queried, the malware substitutes authentic certificates with counterfeit ones, making the controlling service invisible.
Implications for Financial Institutions
The Hirudo RAT’s ability to hijack banking credentials and exert real-time control over devices poses a significant threat to banking app security. It facilitates live screen viewing, captures camera sessions, and collects SMS data, particularly focusing on financial communications.
Experts highlight that Hirudo demonstrates an advanced escalation in the tactics used by Android banking trojans. By embedding its tampering mechanisms within the application itself, Hirudo challenges the integrity checks from within, transitioning the security battle from the device to the application level.
Financial institutions are advised to reinforce their security measures. ThreatFabric recommends server-side verification of Play Integrity, employing layered defenses with behavioral analytics, and integrating risk scoring into transaction-risk controls. These measures aim to detect fraudulent activity and mitigate the impact of compromised applications.
Overall, the emergence of Hirudo exemplifies the need for continuous vigilance and enhanced security protocols in protecting against evolving cyber threats.
