Hirudo Android banking RAT (ThreatFabric, 14 Oct): shopping/adult/short-drama droppers replace genuine bank apps with patched copies that disable signature, Accessibility, screenshot and Play Integrity checks from inside the app
ThreatFabric's Mobile Threat Intelligence team published Hirudo on 14 October 2026: a new Android banking remote-access trojan that combines on-device credential theft with live remote control. Victims first install a functional lure (Shopora shopping, 1V1 X adult video, or ZoyaTV/KoiShort short drama) served via Amazon CloudFront with OpenInstall attribution and Meta Pixel IDs; some download routes were still live in October 2026. The lure shows a fake in-app update, installs a separate Hirudo payload, and may briefly raise a blackhole VPN during install. Once Accessibility and notification access are granted, Hirudo can steal banking passwords, payment PINs, device-unlock secrets and SMS, stream the screen, and use both cameras. What sets it apart from overlay bankers is app replacement: for eight Indonesian banking apps across seven banks it uninstalls the genuine app and installs a purpose-built patched copy that keeps almost all of the bank's code but injects a YAHFA/Dobby hooking engine. The engine substitutes the genuine signing certificate, hides Accessibility services, strips FLAG_SECURE, re-signs key-attestation with a publicly leaked keybox (at least two certificates already on Google's revocation list), and relays Play Integrity requests to an operator server. Credential targets named in code also span China, India, Mexico, Morocco and Thailand; the fake checkout carries Malaysian bank and wallet branding. An unsecured backend panel captured in August 2026 exposed thousands of credential and device records. Victim count is unknown; no Australia-specific targeting is stated. Primary: ThreatFabric; wire: BleepingComputer.
- Product
- Android banking customers (Hirudo RAT / patched banking-app replacements)
- Versions
- n/a (malware; backend data from Aug 2026; distribution still observed Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- Users: install apps only from Play Store, keep Play Protect on, refuse unexpected Accessibility grants and sideloaded APK updates. Banks: validate signature, attestation and Play Integrity server-side (including revocation of leaked keyboxes), bind checks to sessions and protected actions, and keep behavioural/transaction-risk controls — local app signals must be treated as attacker-influenced once replacement is possible. MDM: restrict sideload and Accessibility grants.
Primary: ThreatFabric — Hirudo: From Fake Updates to Patched Banking Apps (14 Oct 2026) · Vendor: ThreatFabric Mobile Threat Intelligence · BleepingComputer — Hirudo Android malware replaces banking apps to evade security checks (14 Oct 2026)