Malware

1V1 X

Tracked since Oct 14, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

6 mentions · peak 3 in a dayToday

Vulns0CVEs used

Actors0Groups

ATT&CK0Techniques

IOCs0Tracked

Type: Dropper
Capabilities: Initial access
Delivery: LureFake updateLanding page
Platforms: Android

1V1 X is an Android adult-content lure application and dropper used to distribute the Hirudo banking Trojan. Also promoted under the branding “1v1 vip,” it provides apparently legitimate entertainment functionality while facilitating installation of a separate malicious application. Its distribution includes a counterfeit app-store-style landing page.

The dropper checks whether the Hirudo payload is installed and whether required permissions are enabled. When the payload is absent, it presents a fake in-app update prompt to induce installation. Hirudo is installed as a separate application and requires its own permissions, including Android Accessibility access.

The delivered Hirudo payload steals banking credentials, payment PINs, SMS messages, and device-unlock information, and supports remote device control, screen streaming, and camera access. It also attempts to replace legitimate banking applications with modified copies containing hooks that conceal tampering and weaken security checks. Prepared replacements target eight Indonesian banking applications across seven banks. These banking-theft and remote-access functions belong to Hirudo rather than independently established capabilities of the 1V1 X dropper.

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyber security newsNews · Oct 22, 2026New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security ChecksLure and dropper application associated with Hirudo distribution. The article identifies its package as com.onev.vip and lists a download route branded 1V1 X. The campaign uses fake update prompts to persuade users to install the separate Trojan payload.Read more ↗cryptika blogNews · Oct 22, 2026New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks | Cryptika CybersecurityLure and dropper used in Hirudo's two-app distribution chain. Users are prompted to install a separate package carrying the banking Trojan under the pretext of an update.Read more ↗cysecurity newsNews · Oct 15, 2026Hirudo Android Malware Replaces Banking Apps to Evade Security Checks - CySecurity News - Latest Information Security and Hacking IncidentsAdult-content app identified as a Hirudo delivery vehicle. It belongs to the loader set that combines expected app functionality with fake update prompts requesting permissions needed for the banking-app replacement.Read more ↗bleeping computerNews · Oct 14, 2026Hirudo Android malware replaces banking apps to evade security checksAdult-content app explicitly described as a loader for Hirudo. It provides its advertised functionality while presenting fake update prompts that lead victims into granting permissions, including Accessibility access.Read more ↗

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilitiesCVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Malware

1V1 X

Tracked since Oct 14, 2026 · Updated 2 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

6 mentions · peak 3 in a dayToday

Vulns0CVEs used

Actors0Groups

ATT&CK0Techniques

IOCs0Tracked

Type: Dropper
Capabilities: Initial access
Delivery: LureFake updateLanding page
Platforms: Android

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Activity feed

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

+2 more in the timeline. Sign up to see them

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs it uses.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Threat actor attributionNamed campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilitiesCVEs this family uses for access and lateral movement.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.