Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

A new Android banking trojan named Hirudo has been identified by Dutch mobile security firm ThreatFabric. The malware operates by replacing legitimate banking applications with purpose-built patched versions that are designed to bypass the apps' built-in security mechanisms from within. This technique represents a significant escalation in financial fraud tactics on the Android platform. Researchers found that Hirudo targets at least eight Indonesian banking apps. By patching the legitimate apps, the trojan can circumvent integrity checks and other security measures that would normally detect tampering. This approach allows attackers to intercept credentials and financial data while evading detection by the apps' own security layers.