Hirudo: From Fake Updates to Patched Banking Apps
A new Android banking remote access trojan named Hirudo has been identified, combining credential theft with live remote control. It is delivered through shopping and entertainment apps that act as droppers, installing the trojan as a separate package behind fake update prompts. The malware replaces legitimate banking applications with patched versions that disable security checks from within the app itself. Eight Indonesian banking apps covering seven banks have been targeted with purpose-built replacements embedding a hooking engine. The campaign uses real advertising infrastructure including Amazon CloudFront for distribution, with targeting extending beyond Indonesia to China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records.
Pulse ID: 6acf85338bff164de62a2759
Pulse Link: https://otx.alienvault.com/pulse/6acf85338bff164de62a2759
Pulse Author: AlienVault
Created: 2026-10-14 13:35:47
Be advised, this data is unverified and should be considered preliminary. Always do further verification.