Loading malware…
KoiShort is an Android lure application and dropper used to distribute the Hirudo banking Trojan. It presents apparently legitimate short-drama content and provides advertised functionality while facilitating installation of a separate malicious payload. Its distribution also includes a casino-themed route. The dropper workflow checks whether Hirudo is installed and uses fake in-app update prompts to persuade users to install the payload, which requires its own permissions.
KoiShort is an initial delivery component rather than the banking Trojan itself. The Hirudo payload abuses Android Accessibility services, steals banking credentials and payment PINs, collects SMS messages, and supports remote screen viewing and camera access. Hirudo also attempts to replace legitimate banking applications with modified copies that undermine application security checks. Its prepared banking-app replacements target Indonesian banks, while its credential targeting extends to additional countries.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.