Security researchers report a new Android malware family, “Hirudo,” that combines banking-trojan capabilities with a full-featured remote access tool (RAT). Instead of only intercepting traffic, it targets victims by replacing legitimate banking applications on their devices with trojanized versions.
Across the outlets, the core method is described as app replacement: Hirudo installs modified banking apps that include changes intended to defeat the apps’ built-in security or fraud-detection routines. One report describes the malware as a way to disable security checks from inside the banking app itself, enabling theft of banking credentials. Researchers also say the malware can be used beyond credential theft due to its RAT functionality.
ThreatFabric is cited as having identified replacements for multiple banking apps, including eight Indonesian banking applications, suggesting the campaign focuses on specific regional targets. The coverage frames Hirudo as an escalation in Android financial fraud because it aims to bypass protections that normally run within the banking apps, rather than relying solely on external overlays or interception.
