Fake overlay screens are the old trick. Hirudo, a new Android banking trojan, goes after the app itself, and that should worry anyone who assumes their bank’s built-in protections will hold up on a compromised phone.
Security firm ThreatFabric identified Hirudo as a banking remote access trojan. ThreatFabric says it “combines on-device credential theft with live remote control of the same phone.” The malware arrives through shopping and entertainment apps that carry it as a separate installation package. So the app you install looks harmless, and the payload rides along.
Hirudo sits alongside the current generation of Accessibility-driven Android bankers. Accessibility services are a legitimate feature built for users who need assistance, but they give an app broad power to read the screen and perform taps. Malware authors have abused that for years. What sets Hirudo apart, according to ThreatFabric, is what happens once a bank is in its sights. Instead of drawing a fake screen over the genuine app, it tries to replace the banking app with a modified copy that “quietly disables the bank’s own security checks from the inside.”
That distinction matters. Many banking apps run integrity checks, root detection and overlay detection. A tampered copy can simply have those removed. The user opens what looks like their normal bank app, logs in, and the attacker gets the credentials. Because the trojan also supports live remote control, the attacker can then act from the victim’s own device, which is exactly where a bank’s fraud systems expect to see them.
The feature list is broad. Hirudo combines:
- Credential phishing
- Full device takeover
- Screen capture
- Camera access
- SMS theft, which defeats one-time passcodes sent by text
For privacy, that last combination is ugly. Screen capture and camera access go well beyond banking. Anything on your display, and anything the camera sees, is exposed.
Right now the reach is limited. The malware targets seven banks and eight Indonesian banking apps. But the code references credential targets in Indonesia, China, India, Mexico, Morocco and Thailand. Expect that scope to grow. Operators rarely build this much tooling for a handful of apps and stop there.
Pricing and availability don’t apply here, but distribution does. Neither the report nor the source article says how the shopping and entertainment apps are spread, or whether any appeared on Google Play. That’s the question I’d want answered first. The advice to avoid sideloaded apps is sensible, yet it is not a complete defense if dropper apps can slip past store review, which has happened repeatedly with other families.
Hirudo fits a clear trend. Banking trojans keep getting more capable, and attackers have moved from simple overlays to full device control. Each step shifts the burden onto the user and onto Android’s permission model. Accessibility access remains the weak point. If an app you just installed asks for it and doesn’t obviously need it, deny it. Be wary of any installer that asks you to install a second package. And if your banking app suddenly asks you to reinstall or update from outside the official store, stop.
Common sense helps, but it isn’t a security model. Google and the banks should be doing more to limit Accessibility abuse and to verify app signatures server-side, rather than trusting checks that live inside an app the attacker can rewrite.