> For the complete documentation index, see [llms.txt](https://docs.talsec.app/appsec-articles/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.talsec.app/appsec-articles/articles/alert-hirudo-the-android-banking-trojan-that-patches-the-banks-own-app-and-how-talsec-stops-it.md).
# \[Alert] Hirudo: the Android banking trojan that patches the bank's own app — and how Talsec stops it
**TL;DR** — Hirudo is a new Android banking RAT (first detailed by ThreatFabric in October 2026) that doesn't just overlay a fake screen on your app. It **uninstalls the genuine banking app and installs a trojanized, re-signed copy** that carries an in-app hooking engine. That engine runs inside the bank's own process and **blinds the app's own security checks** — signature verification, accessibility enumeration, screen-capture protection, key attestation, and Play Integrity. It is the clearest proof yet that **client-side-only app integrity is not enough**, and that security signals have to be verified on your backend. Talsec's layered RASP + server-verifiable **AppiCrypt** model is built for exactly this threat.
***
## Talsec controls vs. Hirudo
| Hirudo technique | What it attacks | Talsec control | Available in |
| --------------------------------------------------------------------------------------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| Trojanized bank app **re-signed with a public Android test key**, keeping the original package name | App signature / integrity | **App integrity & repackaging detection** (signature + tamper check) | freeRASP · RASP+ |
| In-app **hooking engine (YAHFA + Dobby)** injected into the `Application` class | In-process runtime integrity | **Hooking-framework & Frida detection** (Java + native hooks) | freeRASP · RASP+ |
| **Accessibility service** used for remote control; query returns an empty list to stay hidden | Accessibility abuse / device takeover | **Accessibility & overlay-abuse detection** | RASP+ |
| **FLAG\_SECURE stripped**, screen streamed over WebRTC | Screen capture of banking screens | **Screenshot & screen-recording detection** | freeRASP · RASP+ |
| **Play Integrity relayed over plain HTTP** to an operator server that returns a forged verdict | Device/app attestation | **AppiCrypt® — server-verified App Integrity Cryptogram** (provider-independent, can't be relayed) | AppiCrypt |
| **Key attestation re-signed with a leaked keybox** (certs already on Google's revocation list) | Hardware attestation | **AppiCrypt + server-side attestation & revocation checks** | RASP+, AppiCrypt |
| Delivered by **dropper apps sideloaded from fake Play pages / CloudFront**, not an official store | Distribution / installation source | **Untrusted installation-source detection** | freeRASP · RASP+ |
| Second-stage RAT installed as a companion app; privileged behaviour | Malware | **Malware Detection** | RASP+, Malware Detection (+online App Reputation API) |
| Overlay captures lock-screen **PIN / password / pattern**; companion malware package on device | Credential theft via malicious apps | **On-device malware / suspicious-app detection** | RASP+ |
***
***
## What is Hirudo?
Hirudo is a new **Android banking remote access trojan (RAT)**, documented by ThreatFabric's Mobile Threat Intelligence team on **14 October 2026** and picked up the same week by SecurityWeek and The Hacker News. It combines a classic banking-credential stealer with a **full-featured RAT** — live screen viewing, camera access, SMS collection and real-time remote control of the victim's phone.
What makes Hirudo notable isn't any single capability. It's the **strategy**: instead of painting a fake login screen *on top of* the real banking app (the overlay model that mobile security has spent a decade learning to detect), Hirudo **replaces the real app with a tampered copy** and moves the whole fight *inside* the application — against the app's own integrity checks.
ThreatFabric frames this as a shift from a bespoke patch to **"a reusable engine that can be retargeted at other apps and regions."** Today it ships dedicated replacements for **8 Indonesian banking apps across 7 banks**, but its code already references targets in **China, India, Mexico, Morocco and Thailand**, and its bundled fake-checkout screens carry Malaysian bank/wallet branding localised into eight languages. This is a portable toolkit, not a one-country campaign.
## How the attack works
**1. The lure (dropper).** Victims install a functional-looking decoy advertised on social media — a shopping app (**Shopora**), an adult-video app (**1V1 X / "1v1 vip"**), or short-drama apps (**ZoyaTV**, **KoiShort**). These load real content in a WebView so they feel legitimate. In the background the dropper checks whether the Hirudo RAT is already installed; if not, it shows a fake in-app "update" prompt and side-loads the payload as a **second app**.
**2. Swapping the bank app.** Once active, the RAT uses **Accessibility** to detect an installed target banking app, compares its signing certificate against a stored reference, then shows a fake "update" prompt. It **opens Android's uninstaller for the genuine app without waiting for the user to tap**, downloads the bank-specific replacement in parallel, and drives the installer — again through Accessibility. The replacement **keeps the original package name and version** but is signed with a **public Android test key**. (Android won't install a differently-signed app *over* the real one — which is exactly why Hirudo must remove the original first. ThreatFabric notes the victim can still interrupt both the uninstall and the install.)
**3. The patched app blinds itself.** The trojanized build leaves the bank's own code **almost untouched** — a **single line** injected into the `Application` class loads a self-contained hooking engine from bundled assets. It's built on two open-source frameworks: **YAHFA** (replaces Java methods) and **Dobby** (hooks native functions). The hooks only arm when the RAT drops a shared trigger file, so an idle patched app reveals little under analysis. Running inside the bank app's own process, the engine turns the app's defences against it:
* **Signature check** → the hook *substitutes the genuine certificate and hides the test-key signature*, so the app believes it is untampered.
* **Accessibility enumeration** → the hook *returns an empty list*, so the attacker's controlling accessibility service is invisible to the app.
* **Screen capture** → **FLAG\_SECURE is stripped**, so the banking screen can be viewed and recorded remotely.
* **Key attestation** → attestation certificates are *re-signed with a bundled (leaked) keybox*.
* **Play Integrity** → requests are **relayed over plain HTTP to an operator-controlled server** that returns a verdict for the app to accept.
**4. Theft and remote control.** From there Hirudo steals payment PINs, login passwords and device-unlock secrets (PIN/password/pattern, captured via a full-screen fake pattern overlay or read directly from the lock screen via Accessibility), collects SMS (a **90-day initial scan** plus configured bank/wallet senders — i.e. OTP interception), streams the screen over **WebRTC**, opens **front and rear camera** sessions, and drives the device in real time. A back-office captured in August 2026 already held **thousands of credential entries**, device records and financial profiles.
***
## Sources
* ThreatFabric — *Hirudo: From Fake Updates to Patched Banking Apps* (14 Oct 2026):
* SecurityWeek — *Novel Android Banking RAT 'Hirudo' Replaces Banking Apps With Trojanized Copies* (15 Oct 2026):
* The Hacker News — *Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks* (Oct 2026):
* Aviatrix Threat Research Center — *Hirudo Android Trojan: Patched Banking Apps* (14 Oct 2026):
*Protect your Android and iOS apps against Hirudo-class threats with* [*freeRASP*](https://github.com/talsec/Free-RASP-Community) *and* [*RASP+*](https://talsec.app/)*. Talsec does not distribute or endorse malware; indicators above are summarised from public threat intelligence for defensive purposes.*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.talsec.app/appsec-articles/articles/alert-hirudo-the-android-banking-trojan-that-patches-the-banks-own-app-and-how-talsec-stops-it.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
