Published: October 16, 2026
Author: DigitalSpying Threat Intelligence Desk
Category: Mobile Security & Malware Reverse Engineering
Tags: Android Malware, Hirudo RAT, Banking Trojan, App Tampering, Reverse Engineering, Evasion, Mobile Security, ThreatFabric
Executive Summary
In a dramatic tactical evolution for mobile threats, mobile security researchers at ThreatFabric have uncovered a sophisticated new Android banking Remote Access Trojan (RAT) dubbed Hirudo. Disclosed by BleepingComputer and SecurityWeek, Hirudo abandons the decades-old technique of using overlay screens, instead pioneering a radical defense evasion strategy: swapping legitimate banking applications for pre-patched, trojanized clone copies directly on the victim's device.
By physically replacing official mobile banking APKs with weaponized replicas, Hirudo completely circumvents modern operating system protections (such as Android 13/14/15 restrictions on Accessibility Services and screen overlays). The trojanized clones neutralize root-detection and integrity checks, siphon online banking credentials, intercept two-factor authentication (2FA) SMS codes, and establish a persistent, bidirectional WebSocket RAT connection that gives remote operators real-time interactive control over victim accounts.
Technical Deep-Dive: The Anatomy of Hirudo's App-Swapping Attack
1. Delivery & Social Engineering Lure
The infection chain begins with targeted phishing SMS messages (smishing) or malicious search engine advertisements directing users to deceptive landing pages:
* Fake System/Browser Updates: Victims are prompted to download an APK masquerading as an urgent "Google Chrome Update" or "Android System Security Patch".
* Dropper Execution: Once installed, the lightweight dropper requests standard permissions (such as REQUEST_INSTALL_PACKAGES and notifications) while remaining dormant to evade automated static analysis in app sandboxes.
2. Device Fingerprinting and Target Enumeration
Upon establishing an encrypted command-and-control (C2) channel via HTTPS, Hirudo scans the victim's package manager (PackageManager.getInstalledPackages()):
* Target Profiling: Hirudo searches for specific target banking and cryptocurrency wallet package names (identifying dozens of prominent banking institutions).
* Dynamic Payload Delivery: If a target banking application is detected, Hirudo contacts its C2 infrastructure and downloads a custom, server-generated trojanized APK matching the exact visual branding, version string, and manifest declaration of the installed genuine application.
3. The Unprecedented "App Replacement" Execution Chain
Traditional banking trojans (like Xenomorph or Hook) deploy overlay windows over legitimate apps to steal passwords. Because recent Android updates impose strict sandboxing and flag suspicious Accessibility Service abuses, Hirudo takes a completely different path:
1. The Deceptive Deletion Lure: Hirudo generates a high-priority system dialog mimicking the legitimate bank’s interface, warning the user that "Your banking security version is out of date and must be upgraded immediately to prevent account suspension."
2. Prompts Uninstallation: The prompt directs the user to confirm an uninstallation dialog that uninstalls the genuine banking package from the device.
3. Silent Installation of Trojanized Replica: Hirudo immediately triggers the installation of the downloaded trojanized clone package, signed with an attacker-controlled cryptographic certificate.
4. Stripping In-App Protections: ThreatFabric’s reverse engineering revealed that the attackers decompiled the authentic banking apps and patched the Dalvik bytecode (smali):
* Neutralizing Anti-Tamper & Root Detection: Methods querying SafetyNet, Play Integrity API, or checking for root binaries (/system/bin/su, Magisk) are patched to permanently return true (valid integrity).
* Bypassing Certificate Pinning: Network security configurations and OkHttp certificate pinners are patched to accept custom user certificates or bypass SSL validation.
* Injecting Spyware Hooks: Attackers inject event hooks into login forms and transaction confirmation buttons, streaming entered usernames, passwords, and biometric session tokens directly to the attacker’s C2 server.
4. Interactive RAT Capabilities via WebSockets
Beyond credential harvesting, Hirudo acts as an autonomous Remote Access Trojan:
* Real-Time Automated Transfer System (ATS): When a user initiates a genuine transaction, Hirudo intercepts the recipient account details and transaction amounts in transit, substituting them with money-mule accounts.
* SMS & Notification Interception: Hirudo intercepts incoming SMS broadcasts and pushes them to the C2 server, granting attackers real-time access to One-Time Passwords (OTPs) and transaction verification codes.
* VNC-Style Screen Streaming: Operators can initiate remote VNC/WebSocket sessions to navigate device settings, grant additional runtime permissions, and prevent the user from opening antivirus tools.
Strategic Impact on the Mobile Banking Ecosystem
Hirudo marks an inflection point in mobile cybercrime economics:
* Obsolescence of Overlay Protections: Banks and mobile security vendors that invested millions into detecting Accessibility overlays find their defenses rendered completely moot because the malicious code executes natively from inside the banking app process itself.
* The Blindspot of On-Device App Attestation: When an app's internal integrity routines are decompiled and patched before installation, client-side defenses are blind to the tampering unless backed by hardware-backed attestation verified strictly by cloud servers.
Defensive Recommendations & Enterprise Mobile Hardening
Financial institutions, app developers, and mobile end-users must immediately enact the following countermeasures:
1. Mandate Hardware-Backed Server-Side Attestation:
* Financial applications must never rely on local, client-side root or integrity checks.
* Enforce mandatory server-side verification using Google Play Integrity API with Hardware-Backed Device Integrity tokens. If an app clone signed with an unauthorized developer certificate attempts to authenticate, the server must reject API requests and lock the user account.
2. Deploy Runtime Application Self-Protection (RASP):
* Implement advanced commercial RASP solutions that utilize native code (C/C++ via NDK) and control-flow flattening to make decompilation, bytecode patching, and smali injection exponentially more difficult for threat actors.
3. End-User Security Hygiene:
* Never install application updates or system patches distributed via web browser prompts or SMS links. All authentic app updates are delivered exclusively through the official Google Play Store.
* Review device settings under Settings > Apps > Special app access > Install unknown apps and ensure that web browsers and messaging apps are prohibited from installing third-party APKs.
Sources & Technical Threat Analyses:
* ThreatFabric: Hirudo: From Fake Updates to Patched Banking Apps
* BleepingComputer: Hirudo Android Malware Replaces Banking Apps to Evade Security Checks
* SecurityWeek: Novel Android RAT 'Hirudo' Replaces Banking Apps With Trojanized Copies
* The Hacker News: Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Protections