Loading malware…
Hirudo is an Android banking Trojan with remote-access capabilities, identified by ThreatFabric. It combines banking-credential theft, device surveillance, and live remote control with a workflow that attempts to replace legitimate banking applications with modified copies. Dedicated replacements have been identified for eight Indonesian banking applications across seven banks. Its configured credential targets also include financial applications in China, India, Mexico, Morocco, and Thailand; this configuration does not establish active compromise in every country.
Hirudo is distributed through apparently functional shopping, adult-video, and short-drama applications, including Shopora, 1V1 X, ZoyaTV, and KoiShort. These applications use fake update prompts to induce installation of a separate malicious payload and request permissions, particularly Android Accessibility access. Hirudo identifies targeted banking applications, initiates their removal, and downloads bank-specific replacements. The modified applications preserve the originals' package identities and versions but use a different signing key, requiring removal of the genuine applications first. Users can interrupt removal or refuse installation.
The replacement applications embed a hooking engine based on YAHFA and Dobby that operates inside the banking application's process. It substitutes genuine signing-certificate information, hides enabled Accessibility services, removes screen-capture restrictions, manipulates key-attestation certificates, and relays Play Integrity requests through operator-controlled infrastructure. These mechanisms undermine local security checks and enable observation of protected banking screens.
Hirudo steals banking passwords, payment PINs, SMS messages, and device-unlock information. It uses fraudulent checkout and credential-entry interfaces, including fabricated payment-success results. Remote-access functions include Accessibility-based device interaction, live screen streaming over WebRTC, screenshots, camera access, and audio recording. An exposed operational backend contained thousands of credential entries alongside device, lock-screen, and financial-profile records; the number of victims is unknown.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking malware distributed through shopping and entertainment lure apps using fake update prompts. It abuses Accessibility permissions to initiate removal of genuine banking apps and installation of modified replacements. Embedded hooks conceal altered signatures and enabled Accessibility services, disable screenshot protections, and relay some Play Integrity requests through attacker infrastructure. Hirudo also steals banking credentials, payment PINs, SMS messages and device-unlock information, and supports remote screen viewing and camera access. Researchers identified eight prepared replacement apps covering seven Indonesian banks, with additional credential targets across other countries. Replacement installation depends on user approval.
Android banking malware that uses Accessibility permissions and deceptive update prompts to induce users to uninstall genuine banking apps and install modified replacements. Its replacements hook security checks to conceal altered signatures and enabled Accessibility services, permit screenshots, and relay some Play Integrity requests through attacker infrastructure. Hirudo also steals banking credentials, payment PINs, SMS messages and device-unlock information, and provides remote screen viewing and camera access. Eight prepared replacement apps target seven Indonesian banks, with additional financial credential targets across other countries.
Android malware combining banking-trojan and remote-access capabilities. Distributed through seemingly legitimate applications containing a downloader, Hirudo obtains Accessibility Services permissions and replaces targeted banking apps with modified copies. Its embedded hooking engine bypasses application security checks, conceals active accessibility services, disables screenshot protection, substitutes key-attestation certificates, and redirects Google Play Integrity requests through attacker infrastructure. It steals banking credentials, payment PINs, device-unlock information, and SMS content, while supporting screen streaming, remote control, camera access, and audio recording. Eight Indonesian banking apps are currently targeted; code analysis indicates potential targeting of banks in China, India, Mexico, Morocco, and Thailand. Researchers found thousands of victim-related records in an unsecured operator administration panel, but the exact victim count remains unknown.
Android banking trojan that abuses Accessibility permissions to uninstall genuine banking apps and install modified replacements. It injects a hooking engine based on YAHFA and Dobby into the banking app’s process, allowing it to spoof signing-certificate checks, conceal Accessibility services, disable screenshot protection, modify attestation certificates, and relay Play Integrity requests through attacker infrastructure. It steals banking credentials, payment PINs, device-unlock credentials, and SMS messages, and supports live screen streaming, screenshots, audio recording, and access to both cameras. Fake checkout pages harvest payment PINs while displaying fabricated payment-success messages. It has impersonated at least seven Indonesian banks, with additional targeting in China, India, Mexico, Morocco, and Thailand. An exposed backend contained thousands of credential entries, but the victim count is unknown.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.