HIRUDO TROJAN — BANKING-APP REPLACEMENT — ACTIVE OCT 2026
Cybersecurity news: Hirudo Android trojan — is your banking app secretly a trojan?
Cybersecurity news: security researchers at ThreatFabric uncovered Hirudo, an Android trojan with a brazen trick: instead of faking a login screen, it uninstalls your real banking app and installs a trojanized copy — one that lies to the phone about its own signing certificate, hides its Accessibility access, and relays Play Integrity checks to the attacker's server. Meanwhile it steals credentials, reads your SMS, watches your screen live, and even accesses your camera. This free 30-second check verifies your banking app is genuine. No signup, nothing installed.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
Is your banking app the real one?
Direct answer: check three things right now: the app's install source (Google Play only, never sideloaded), its Play Integrity verdict in your device settings, and whether your bank's app recently "updated" outside the Play Store. If any check fails, uninstall and reinstall from Play. Take the 30-second check below.
1
Verify where your banking app came from — long-press your banking app's icon → App info → look at the installer / installed-from line at the bottom:
Installed from "Package installer", an unknown source, or anything other than Google Play → TREAT AS COMPROMISED. Uninstall it immediately, reinstall fresh from Google Play, and change your banking password from a different, clean device.
Installed from Google Play → good sign. Continue to step 2 — the swap happens after a fake "update", so also confirm you never accepted one.
2
Check for the dropper's footprints — Hirudo arrives inside innocent-looking apps, then asks for dangerous permissions. Check both:
- Unknown apps: Settings → Apps → look for shopping, short-drama, or adult-content apps you installed from outside the Play Store (especially via social-media ads). The known lures include shopping, adult-video, and short-drama apps.
- Accessibility services: Settings → Accessibility → review every enabled service. Hirudo needs Accessibility to perform the app swap and remote control.
Unknown sideloaded apps present, or an Accessibility service you don't recognize → high risk. Remove the unknown apps, disable the mystery service, then run a Play Protect scan.
Ever tapped an in-app "update" prompt for your banking app → that's the attack. Banking apps update only through the Play Store. Reinstall yours fresh.
3
Run Play Protect and update everything — Play Store → profile icon → Play Protect → Scan. Then install all pending system and app updates:
Play Protect won't catch every trojanized copy — the whole point of Hirudo is defeating on-device checks — but it catches the droppers. The researchers found Hirudo ships a publicly leaked attestation keybox whose certificates Google has flagged, so server-side checks can still spot the forgery. Your bank's defenses matter as much as your phone's.
How the attack works — cybersecurity news you can use
- The lure: you install a normal-looking shopping, adult, or short-drama app from a social-media ad. It works as advertised — that's the point.
- The fake update: the dropper detects which banking app you use and shows a convincing "update available" prompt for it. Accepting triggers permission requests, including Accessibility.
- The swap: Hirudo launches your real banking app's uninstaller, downloads a patched copy, and uses its Accessibility permission to install it. You can interrupt it at two points — which is why the prompts pressure you to hurry.
- The forgery: the trojanized copy keeps almost all the original app's code but loads a hooking engine (built on the open-source YAHFA and Dobby frameworks). When the app asks Android for its signing certificate, the hook substitutes the genuine one. When it queries enabled Accessibility services, the hook returns an empty list. Play Integrity verdicts get relayed to the operator's server.
- The payoff: credential and PIN theft, a 90-day SMS trawl (targeting bank and wallet senders), live screen viewing over WebRTC, front/rear camera access, audio recording — and fake checkout screens that harvest PINs behind a counterfeit "payment successful" page.
Observed targeting: eight Indonesian banking apps, with code references to banks in China, India, Mexico, Morocco, and Thailand — the hooking engine is reusable and built to expand. Researchers found an exposed operator panel with thousands of stolen credential and device records dating to August 2026: this is a production-scale fraud pipeline, not a proof of concept.
Protect yourself now
- Banking apps update only via the Play Store. Any in-app "update" prompt for a banking app is the attack — decline it, then verify the app's installer source.
- Never sideload apps from social-media ads — shopping, drama, and adult apps are the known dropper lures.
- Audit Accessibility services regularly. It's the single most abused permission on Android — anything you don't recognize gets disabled.
- Reinstall from scratch if in doubt — uninstall the banking app, reinstall from Google Play, and change your banking password from a clean device.
- Watch your SMS and statements — Hirudo trawls 90 days of messages and harvests PINs through fake checkouts. Unexpected transactions or OTPs you didn't request mean act now.
Hunt the infrastructure behind mobile trojans → BreachHunter
This page checked one trojan. BreachHunter tracks attacker infrastructure and compromise indicators — the operator panels and malicious domains behind campaigns like Hirudo.
FROM INGENIOUS AI
Ingenious AI builds 11 AI security platforms — disclosure compliance, rogue-agent defense, breach hunting, agent oversight, and more.
Our platforms are being upgraded and return November 1 — get early access now:
Get early access on WhatsApp →
Frequently asked questions
What is the Hirudo Android trojan?
Hirudo is an Android banking trojan analyzed by ThreatFabric in October 2026. Instead of overlaying fake login screens, it uninstalls your real banking app and installs a near-identical trojanized copy with a hooking engine that falsifies the app's own security checks — signing certificate, Accessibility services, screenshot protection, and Play Integrity — while stealing credentials and enabling live remote control.
How does Hirudo get on my phone?
Through dropper apps that look legitimate — shopping apps, adult-content apps, or short-drama apps advertised on social media. After install, the dropper shows a fake 'update' prompt for your banking app, asks for Accessibility permission, then swaps the real banking app for the trojanized copy.
How do I know if my banking app is the real one?
Check the app's installer source: on Android, long-press the app icon, tap App info, and verify it was installed from Google Play — not from a package installer or unknown source. Never accept in-app 'update' prompts for banking apps; updates come only through the Play Store.