ThreatFabric published its analysis of Hirudo on October 14. The Android banking trojan combines credential theft with remote device control. Its documented feature is replacing some banking apps with modified copies that neutralize local checks. Researchers identified tailored replacements for eight apps from seven Indonesian banks.
How Hirudo reaches a phone
The malware is delivered alongside shopping or entertainment lure apps. After installation, a fake update prompt offers a second APK and requests sensitive permissions. The report also describes how accessibility permissions can support installation and device control.
Modified copies of banking apps
For targeted apps, Hirudo attempts to uninstall the genuine version and install a modified copy under the same package name. A hooking engine can hide some signature or integrity checks and collect credentials. The technique requires user actions and permissions; it does not automatically compromise all Android users.
Observed scope and limits
ThreatFabric identified eight tailored replacements for seven Indonesian banks. Other countries appear in targeting lists, but this does not prove confirmed victims there. The report describes thousands of records in a control panel observed in August, not a count of unique victims.
What to do after a suspicious install
Do not install APKs from received links or approve unexpected update prompts. If an unknown app received accessibility access, contact your bank through its official website or number, check transactions from another trusted device, and have the phone examined.
How Soclyde fits
Unique passwords can reduce reuse across services, but they do not make a malware-controlled phone safe. Soclyde helps manage credentials without replacing banking-app protections or device checks. Read our guide to password reuse risks.
What to remember
Hirudo shows why a familiar banking app may have been modified. Avoid unexpected installations, review permission requests carefully, and contact your bank if you suspect tampering.
