Android RAT Hijacks Banking Apps by Replacing Them with Trojanized Versions

A new Android remote‑access trojan, named Hirudo, has been uncovered by security researchers. The malware replaces authentic banking apps with modified copies that hide inside the same package name and appear as updates. While the user sees a standard update dialog, the original app is removed and a trojanized version is installed, allowing the attacker to steal credentials and remotely control the device.

How the malware spreads

The dropper that delivers Hirudo masquerades as a common shopping, drama or adult‑video app. It loads content in a WebView to make the interface look legitimate. When a banking app is detected on the device, the dropper shows a fabricated in‑app update prompt, then automatically uninstalls the real app and initiates download of the replacement.

Only eight Indonesian banking apps from seven banks currently have dedicated replacements. The trojan checks the signing certificate of each target app, and when a match is found, it triggers the uninstall and downloads a patched copy signed with a test key. The replacement keeps the original package name and version but contains a single line that loads a hooking engine when a trigger file is present.

Hidden tampering inside the app

Inside the modified app the hooking engine, built with YAHFA and Dobby, intercepts calls to obtain the app’s signing certificate, the list of enabled accessibility services and Play Integrity checks. It returns falsified data, clears the flag that blocks screenshots, and relays integrity responses through a server controlled by the attackers. The trojan also provides remote camera, screen‑capture, WebRTC viewing and SMS harvesting capabilities.

Security experts warn that any local signals produced by a tampered app—such as certificate verification, accessibility lists or integrity verdicts—must be treated as suspect. They recommend server‑side validation, layered behavioural analytics and maintaining backend transaction‑risk controls. The operation also exposed an unprotected cloud panel that let researchers map the supply chain and see how the dropper and replacement apps were assembled.