ThreatFabric has disclosed a new Android banking RAT called Hirudo that can replace legitimate banking apps with modified copies designed to manipulate their own security checks, including app-signing validation, Accessibility detection and Play Integrity responses.
Rather than simply stealing credentials or displaying overlays, Hirudo can make a compromised banking app appear trustworthy to itself and to controls that rely on signals generated on the device.
In response, mobile app security expert Ted Miracco, CEO of Approov, offers comments:
“Hirudo doesn’t break the bank’s defenses. The trojan deletes the genuine app, installs a copy signed with a public test key, and loads a hooking engine inside that app’s process. From then on that app asks Android who signed it and hears the right answer. It asks which accessibility services are running and hears none. Its Play Integrity request is routed through the attacker’s server and comes back clean.
“The conclusion is uncomfortable but simple: an app running on a phone you don’t control cannot be a witness in its own defense. Integrity signals have to be produced and judged somewhere the attacker can’t reach, tied to the session and to the specific payment, with revocation actually checked. ThreatFabric found the operators using a leaked keybox holding certificates Google had already revoked. A bank checking server-side would have caught that. A bank trusting the verdict on the handset could not.
“The uncomfortable part for the industry is that this engine isn’t bank-specific. It’s a reusable tool pointed at eight Indonesian apps today, with target lists in the code already naming five other countries.”
This is not a good development as I expect this to be repurposed to fit any use case. Which is bad for all of us.
Related
This entry was posted on October 15, 2026 at 4:59 pm and is filed under Commentary with tags Android. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Hirudo Android RAT kills, replaces & runs banking apps
ThreatFabric has disclosed a new Android banking RAT called Hirudo that can replace legitimate banking apps with modified copies designed to manipulate their own security checks, including app-signing validation, Accessibility detection and Play Integrity responses.
Rather than simply stealing credentials or displaying overlays, Hirudo can make a compromised banking app appear trustworthy to itself and to controls that rely on signals generated on the device.
In response, mobile app security expert Ted Miracco, CEO of Approov, offers comments:
“Hirudo doesn’t break the bank’s defenses. The trojan deletes the genuine app, installs a copy signed with a public test key, and loads a hooking engine inside that app’s process. From then on that app asks Android who signed it and hears the right answer. It asks which accessibility services are running and hears none. Its Play Integrity request is routed through the attacker’s server and comes back clean.
“The conclusion is uncomfortable but simple: an app running on a phone you don’t control cannot be a witness in its own defense. Integrity signals have to be produced and judged somewhere the attacker can’t reach, tied to the session and to the specific payment, with revocation actually checked. ThreatFabric found the operators using a leaked keybox holding certificates Google had already revoked. A bank checking server-side would have caught that. A bank trusting the verdict on the handset could not.
“The uncomfortable part for the industry is that this engine isn’t bank-specific. It’s a reusable tool pointed at eight Indonesian apps today, with target lists in the code already naming five other countries.”
This is not a good development as I expect this to be repurposed to fit any use case. Which is bad for all of us.
Share this:
Like this:
Related
This entry was posted on October 15, 2026 at 4:59 pm and is filed under Commentary with tags Android. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.