Hirudo Malware Replaces Indonesian Banking Apps With Clones to Steal Credentials
A new malware campaign targets Indonesian bank customers by replacing legitimate applications with modified versions that steal credentials and bypass security checks.
Key points
- Hirudo removes genuine banking apps and installs malicious clones that retain original names and version numbers to evade detection.
- The threat actors target eight Indonesian banking applications across seven banks, using fake shopping and entertainment apps as initial lures.
- Once installed, the Trojan acts as a remote access tool, stealing passwords, PINs, SMS messages, and enabling camera and screen monitoring.
Customers of seven major Indonesian banks are facing a new financial threat that compromises their devices by replacing legitimate banking software with malicious copies. This malware, identified as Hirudo, specifically targets users who download seemingly benign shopping or entertainment applications from unofficial sources. The campaign aims to steal sensitive financial data and gain remote control over infected Android phones.
Hirudo operates by first tricking users into installing a lure app, often themed around shopping, adult videos, or short dramas. These initial apps, such as Shopora or ZoyaTV, appear normal but check for the presence of the actual Trojan. If the malware is not yet installed, the lure presents a fake update prompt, persuading the user to install a second package that contains the malicious code and requests necessary permissions.
How the Malware Bypasses Security
Unlike simpler threats that overlay fake login screens, Hirudo modifies the banking application itself. According to ThreatFabric analysts, the malware uses Android’s Accessibility service to detect targeted banking apps and verify their signing certificates. It then triggers a false update message and opens the system uninstaller for the genuine app. A modified copy, which retains the original app’s name and version number, is downloaded and installed in its place.
This replacement contains extra code designed to interfere with security checks. The modified app returns answers that hide the malware’s presence, making it difficult for standard security tools to detect the intrusion. This method allows the operators to maintain persistent access to the victim’s device while evading detection mechanisms that look for overlay attacks or unknown applications.
Who Is Affected by Hirudo
ThreatFabric researchers identified replacement copies prepared for eight Indonesian banking apps covering seven specific banks. The malware is currently focused on the Indonesian market, but the researchers noted a wider set of financial apps in the target list. This suggests the operators have built a flexible system that could be adapted to target banks in other regions or sectors beyond the initial seven identified institutions.
Our take on the response
The sophistication of Hirudo’s app-replacement technique highlights a shift in how Android banking Troopers operate. By modifying the actual application rather than just overlaying fake interfaces, attackers can bypass many standard security checks that look for unusual behavior or unknown overlays. This approach makes detection significantly harder for both users and automated security tools, requiring more advanced behavioral analysis to identify the compromise.
For customers and users
Users should verify the integrity of their banking applications by checking the source of the install package. If an app was not downloaded from the official Google Play Store, it should be removed immediately. Look for unexpected permission requests, particularly for Accessibility services, which can allow malicious apps to control other applications. Monitor for unusual battery drain or data usage, which may indicate background activity. Be cautious of fake update prompts within non-banking apps, as these are common lures for malware installation.
What to do and how to stay safe: Hirudo
- Check your device for any recently installed apps from unknown sources, especially those related to shopping, video, or entertainment, and uninstall them immediately.
- Review the permissions granted to all apps, particularly Accessibility services, and revoke access for any application that does not require such high-level control.
- Verify that your banking applications are the genuine versions by checking their package signatures or reinstalling them directly from the official app store.
- Monitor your bank accounts and SMS messages for any unauthorized transactions or login attempts, and report any suspicious activity to your financial institution.
Step-by-step guide: How to Stop Ransomware: 3 Layers That Actually Work
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which banks are targeted by the Hirudo malware?
ThreatFabric analysts found replacement copies prepared for eight banking apps across seven Indonesian banks, though the target list may expand.
How does Hirudo install itself on a user's device?
It uses lure apps themed around shopping or entertainment to display fake update prompts, tricking users into installing the malicious second package.
Can Hirudo access the camera and screen of an infected phone?
Yes, the malware functions as a remote access Trojan, allowing operators to view the screen, access cameras, and steal credentials and PINs.
