Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.

Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand.

"The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," Eward Driehuis, vice president of fraud engineering at ThreatFabric, said in a statement shared with The Hacker News.

Hirudo facilitates on-device credential theft and live remote control. The malware is delivered by shopping, adult video, and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update.

"The lure is functional, loading real content in a WebView, a storefront, a video catalogue or short dramas, so the experience looks legitimate," ThreatFabric explained. "Behind that content the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches its campaign configuration, and checks whether the payload, the Hirudo RAT, is already installed with its accessibility service and notification access enabled."

If it's not present, it displays a fake in-app update prompt to trigger the installation of the malware. It's worth emphasizing that Hirudo is installed as a second app and must be granted its own permissions before it can carry out the malicious activities.

Source link