On October 14, 2026, ThreatFabric reported that Hirudo, an Android banking remote-access trojan (RAT), can replace selected banking apps with modified copies that manipulate checks inside the app. The company’s analysis describes eight dedicated replacements across seven Indonesian banks and a separate registry of 42 financial apps. ThreatFabric’s report also explains why the replacement requires removing the genuine app first—and what banks can check on their servers instead.
How Hirudo replaces a banking app
ThreatFabric says the attack starts with a lure app that offers functional content, such as a storefront or video catalog. A fake in-app update then installs Hirudo as a separate app, which needs its own permissions before its collection and control features can run. Reported lure examples include Shopora, 1V1 X, KoiShort and ZoyaTV.
For a targeted banking app, Hirudo reportedly detects the installed app, checks its signing certificate and presents an update prompt. It opens Android’s uninstaller for the genuine app while downloading a bank-specific replacement. The replacement keeps the original app’s package name and version, but uses a public Android test key instead of the bank’s signing key. Android therefore will not install it over the genuine app: the original has to be removed first, and the user must authorize the replacement’s installation.
That signing mismatch creates a point where the sequence can be interrupted. A prompt to remove a bank’s app or install a replacement should not be treated like an ordinary app update.
What the modified app changes
ThreatFabric says Hirudo loads a hooking engine built on YAHFA and Dobby inside the patched banking app. The hooks reportedly let the modified app return the genuine signing certificate, conceal enabled Accessibility services, remove the FLAG_SECURE screen-capture restriction and relay Google Play Integrity requests to an operator-controlled server over plain HTTP.
The report says the engine uses a publicly leaked keybox for key attestation, and that at least two certificates in it appear on Google’s attestation revocation list as compromised. A Play Integrity response alone cannot show that an app is untampered when the request is relayed and the app can influence the result.
What the reported targets and data cover
ThreatFabric describes several distinct scopes: eight Indonesian banking apps with dedicated replacements across seven banks, and a broader registry of 42 financial apps. Its analyzed credential-target data names Indonesia, China, India, Mexico, Morocco and Thailand. The bundled fake checkout also carries Malaysian bank and wallet branding.
The checkout reportedly appears as a transparent WebView over the lure app’s order page. ThreatFabric says it can capture a payment PIN, send it as appPayPwd and return a forged purchase-success result. Other reported functions include fake bank-login prompts, lock-screen-secret capture, live screen viewing over WebRTC, camera sessions, remote control and SMS collection. The SMS function was configured for an initial 90-day scan and a list of bank and wallet senders.
ThreatFabric also reported that lure APKs were served through Amazon CloudFront and that campaign links used OpenInstall attribution and Meta Pixel IDs. An operator APK-processing panel was reportedly reachable without a login, with storage buckets and credentials exposed. Backend records captured in August 2026 included thousands of application-credential entries, device records, lock-screen history and financial profiles with monthly-income and risk-score fields.
The checks banks can perform
ThreatFabric recommends verifying Play Integrity on the server, binding each verdict to the user’s session and the protected action, and checking whether attestation certificates have been revoked. It also recommends behavioral analytics and backend transaction-risk controls. Accessibility and screen-capture signals can contribute to a decision, but the report advises against relying on either as a stand-alone blocker.
The Hacker News reported ThreatFabric’s assessment that a deliberately non-functional VPN used during installation can reduce cloud-based checks, while Google Play Protect retains offline detection for known potentially harmful apps. The Hacker News’ report attributes that qualification to ThreatFabric.
