- ThreatFabric reports that the Hirudo Android trojan can replace eight Indonesian banking apps with patched copies, but only after the victim removes the real app.
- The copies hide tampering from the app's own signature, accessibility and Play Integrity checks, so a phone-side signal alone is weak proof.
- ThreatFabric advises banks to verify integrity on their servers, check attestation revocation and keep server-side risk controls on sign-in, recovery, payees and payments.
A banking app tells the bank, "I am genuine, unmodified and running on a safe phone." The bank has to decide whether to believe it. ThreatFabric, a Dutch mobile security firm, has described an Android trojan called Hirudo. It shows why that answer is weak once the app has been replaced. The replacement covers eight Indonesian banking apps. It works only after the victim removes the real app. But once armed, the copy answers the bank's security questions however the attacker chooses.
A check run on the phone is a statement from the suspect
Any bank that treats phone-side signals as proof is exposed. Signature checks, lists of active accessibility tools and integrity verdicts all feel like evidence. ThreatFabric says that once an app can be replaced, these signals are "attacker-influenced". They need to be checked on the bank's servers. A phone-side check is closer to a suspect vouching for himself than to a witness.
How the swap works
Hirudo comes in two parts. The victim first installs a dropper, an app whose job is to deliver something else. The decoys are shopping, adult-video and short-drama apps. One is called Shopora. They load real content, so they look genuine.
The dropper then shows a fake in-app update prompt. It offers the real payload, the Hirudo remote access trojan, as a second app. The victim must grant it permissions before it can act. In one shopping dropper, a fake VPN also cut off the phone's IPv4 traffic during the install.
Hirudo lists 42 financial apps as targets. Just eight get a ready-made patched copy. All eight are Indonesian and belong to seven banks. For those, the trojan spots the bank app and checks its signing certificate. It then shows another fake update prompt. At the same moment, it opens Android's uninstaller for the real app and starts downloading the copy.
What the copy does to the bank's checks
The copy keeps the bank's package name and version. Its signature, though, comes from a public Android test key, not the bank's own. Android will therefore not install it over the real app. The real app has to go first. ThreatFabric calls this a real constraint, because the victim can interrupt the process.
Inside the copy, the bank's code is left almost untouched. One added line loads a hooking engine at launch. Hooks swap an app's normal answers for different ones. The engine uses two open-source tools, YAHFA and Dobby. It arms itself only when the trojan has left a trigger file on the phone. An idle copy reveals little.
Once armed, the engine turns the app's defences against it. It hands back the genuine signing certificate. It reports no accessibility services. It removes FLAG_SECURE, the setting that blocks screen capture. It re-signs key attestation certificates with a bundled keybox. For Play Integrity, it sends the request over an unencrypted web connection to the attackers' server. That server returns a verdict, and the app accepts it.
A weakness in the attackers' own kit
The researchers found one flaw that defenders can use. The attackers did not make the keybox. It had already leaked publicly. Google's list of revoked attestation certificates already flags at least two certificates from that keybox as compromised, ThreatFabric found. A bank backend that checks revocation can still catch those forgeries.
ThreatFabric also found the attackers' APK-processing panel open without a login. Storage buckets and credentials were exposed.
Narrow replacement, wider ambition
The replacement targets Indonesia only. The trojan's code also names credential targets in China, India, Mexico, Morocco and Thailand. Its fake checkout page carries Malaysian bank and wallet branding. ThreatFabric reads the multi-country target lists and country-labelled backend groups as a sign that the toolkit is reusable beyond any single bank.
The lures spread through ordinary advertising tools. ThreatFabric saw Amazon CloudFront hosting, OpenInstall attribution and shared Meta Pixel IDs. Its checks from late September into October 2026 found some download links still working.
ThreatFabric also reviewed records captured in the attackers' exposed backend in August 2026. They included thousands of application-credential entries. Eward Driehuis, ThreatFabric's vice president of fraud engineering, described "a fairly mature backend" to The Hacker News. Those entries do not equal confirmed victims. The report gives no victim count or loss figure. The scale of real fraud is unknown from this source.
What the report does show is a method. ThreatFabric describes a reusable engine that can be pointed at other apps and regions.
Questions to put to your fraud and mobile teams
ThreatFabric's advice for financial institutions is concrete. Leaders can turn it into questions.
Do we verify Play Integrity on our servers? Is the verdict tied to the session and the specific action? Do we check attestation revocation? A valid verdict alone is not enough. Hirudo relays the request through its own server.
Do accessibility and screen-capture signals feed a risk score, or do they act as blockers? Patched apps can hide the first and strip the second. Neither should stand alone.
Where does a forged phone-side result stop mattering? ThreatFabric says to keep decisions on the bank's side at the key moments: sign-in, account recovery, adding a payee and approving a payment. It also recommends behavioural analytics. If malware blocks that data, the gap is itself a warning sign.
The bank can only trust what it can check for itself. Anything the phone says about itself is a claim, and Hirudo's engine is built to rewrite those claims.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ThreatFabric.
