Android malware 'Hirudo' replaces Indonesian banking apps with trojanized copies
ThreatFabric says the malware combines credential theft with live remote control of the infected phone.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Security firm ThreatFabric has analyzed Hirudo, a new Android malware that combines a banking trojan with a full remote access tool. SecurityWeek and Security Affairs both reported on it. According to SecurityWeek, the infection starts with a dropper hidden inside apps that look genuine and are advertised on social media, including a shopping app, an adult video app and a short-drama app. Once installed, the dropper checks whether Hirudo is already on the phone and installs it if it is not. The malware currently targets eight Indonesian banking apps. When it finds one, it shows a fake update prompt, uninstalls the real app and installs a modified copy. That copy can then disable security controls from inside the app. Hirudo also lets attackers watch the screen live over WebRTC, use the camera and control the phone through Android Accessibility Services. Code inside the malware suggests it could later target banks in China, India, Mexico, Morocco and Thailand. Replacing the banking app itself, instead of drawing a fake screen over it, makes the fraud harder for users and many app-level protections to spot.