How Android Banking Malware Hijacks App Integrity Checks to Steal Data
The Hirudo trojan replaces legitimate banking applications with modified copies that hide remote control activities from standard security checks.
Key points
- The malware substitutes genuine banking apps with trojanized versions that bypass signature and integrity verification.
- Threat actors deliver the payload via droppers hidden in shopping, adult video, or drama apps advertised on social media.
- The code currently targets eight Indonesian banks, with internal markers suggesting potential expansion to China, India, and Mexico.
The Hirudo malware operates by replacing legitimate banking applications on Android devices with modified copies that contain hidden backdoors, according to SecurityWeek. This remote access trojan combines traditional credential theft with live remote control capabilities, allowing attackers to view screens, access cameras, and interact with the device through accessibility services. The malware specifically targets financial applications to intercept user activity.
How does the malware bypass security controls?
The trojanized replacement apps include a hooking engine designed to neutralize internal security checks from within the application itself, as reported by SecurityWeek. When the modified app queries Android for its signing certificate, the hook substitutes the genuine certificate to hide the malicious test-key signature. It also returns an empty list when queried about enabled accessibility services, rendering the remote control components invisible to standard detection methods. This approach shifts the security contest from the device level to the application’s own integrity mechanisms.
How is the malware delivered to victims?
Distribution occurs through droppers embedded in seemingly legitimate downloaded content, such as shopping, adult video, or short drama applications advertised via social media, according to SecurityWeek. Users install what appears to be a benign application, but the contained dropper checks for the presence of the Hirudo RAT and installs it if missing. The malware then detects specific banking apps on the device, displays a fake update prompt, uninstalls the genuine application, and downloads its own modified replacement.
Which regions and apps are targeted?
The current iteration of the malware focuses on eight Indonesian banking applications, SecurityWeek reports. However, internal code analysis suggests the threat actors have prepared the infrastructure to target banks in China, India, Mexico, Morocco, and Thailand. The malware steels credentials, collects SMS messages including a 90-day initial scan, and monitors a configured list of bank and wallet senders to facilitate financial theft.
What is the operational significance?
Researchers note that this method represents an escalation in how attackers approach hardened applications, according to SecurityWeek. By moving tampering inside the target app, the operation creates a reusable engine that can be retargeted at other apps and regions more easily than bespoke patches. This technique undermines trust in local signals produced by an app that may have been replaced, complicating detection efforts for both users and automated security tools.
What analysts watch for
Security teams should examine application behavior for anomalies in signature verification and accessibility service reporting, as these are common evasion tactics in this malware category. Analysts typically check for unexpected app replacements following social media engagement and monitor for droppers in non-financial applications. Teams usually inspect live screen viewing capabilities and remote camera access indicators. Check whether integrity checks are being bypassed from within the application rather than at the system level.
What to do and how to stay safe: Android
- Verify the integrity of installed banking applications by comparing their signatures against known good values from official sources.
- Monitor for fake update prompts that request uninstalling existing financial apps before installing new versions.
- Review enabled accessibility services regularly to identify any unauthorized remote control components that should not be present.
- Install applications only from official app stores and avoid clicking on links to financial tools from social media advertisements.
Step-by-step guide: How Windows Malware Removal Works: The Hidden Persistence Layer
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the malware steal passwords?
Yes, the Hirudo RAT steals banking credentials and collects SMS messages, including a 90-day initial scan of relevant senders, according to SecurityWeek.
Can the malware control the device remotely?
Yes, it provides live screen viewing via WebRTC, remote camera access, and remote interaction through Android Accessibility Services, as reported by SecurityWeek.
Are other countries at risk?
Internal code suggests the malware could be retargeted at banks in China, India, Mexico, Morocco, and Thailand, according to SecurityWeek.
