Hirudo Android malware steals financial credentials by replacing genuine banking apps with modified copies. These replacements retain most original functionality while interfering with security checks designed to protect customer accounts.
Researchers identified malicious versions of eight banking apps. Beyond stealing login details, the malware lets attackers remotely control infected phones, read messages and record audio.
So far, investigators have observed impersonations of at least seven Indonesian banks. However, the broader targeting also includes financial organizations in China, India, Mexico, Morocco and Thailand.
Fake Updates Start the Infection Process
The attack begins with apps that offer shopping, adult content or short dramas. Examples include Shopora, 1V1 X, ZoyaTV and KoiShort.
These apps provide their advertised features, helping them appear credible. However, they also act as loaders that introduce Hirudo through fake update notifications.
Those prompts guide users toward granting powerful permissions, including access to Android’s Accessibility services. The malware then abuses that access during the banking app replacement process.
First, Hirudo opens the legitimate banking app’s uninstaller. Next, it downloads a modified replacement and uses Accessibility permissions to help install it.
Nevertheless, the replacement process is not seamless. Researchers identified two stages where the victim can interrupt the operation.
Modified Banking Apps Undermine Their Own Security Checks
The replacement apps preserve almost all the original banking software’s code. However, they also load a hooking engine built with the open-source YAHFA and Dobby frameworks.
This engine operates inside the banking app’s own process, allowing it to manipulate responses to security checks.
For example, it supplies the genuine signing certificate when the app requests certificate information. It also conceals active Accessibility services by returning an empty list.
Meanwhile, the altered app removes screenshot restrictions, enabling attackers to view and record content that would normally remain protected.
Other changes affect key-attestation certificates and route Play Integrity requests through a server controlled by the attackers. Together, these techniques aim to undermine checks that could expose the modified app or its operating environment.
Compromised Certificates Leave a Detection Opportunity
Despite these capabilities, Hirudo’s evasion methods have limitations.
Researchers found that its bundled attestation keybox had already leaked publicly. Google also lists two associated certificates as compromised.
Consequently, banks that check certificate revocation on their servers can detect those compromised certificates. This creates an opportunity to identify forged attestation evidence despite the malware’s interference inside the app.
Hirudo Collects PINs, Messages and Device Secrets
Once active, Hirudo Android malware can collect banking passwords, payment PINs, device-unlock secrets and SMS messages.
Additionally, attackers can stream the phone’s screen, capture screenshots, record audio and access both cameras. These capabilities support real-time surveillance and remote control.
The operation also uses fake checkout pages to capture payment PINs. After collecting the information, those pages display a fabricated payment-success message to mislead the victim.
Researchers discovered thousands of application-credential entries in an unsecured backend panel. The exposed records also included device information, lock-screen data and financial profiles.
However, those entries do not establish how many people suffered an infection. The total victim count remains unknown.
Server-Side Validation Can Help Banks Detect Tampering
The findings highlight an approach that targets protections inside banking apps, alongside checks on the surrounding device environment.
Researchers therefore recommend validating integrity and attestation evidence on bank-controlled servers. They also advise tying those checks to individual sessions and sensitive actions.
Furthermore, banks should maintain behavioral monitoring and transaction-risk controls to help identify suspicious activity.
For Android users, the recommendations include keeping devices updated and avoiding APK downloads from unofficial stores. Regular Play Protect scans provide another precaution against malicious software.
0 responses to “Hirudo Android Malware Swaps Banking Apps for Credential-Stealing Copies”