A newly uncovered Android banking trojan is taking a novel approach to financial fraud: instead of overlaying fake login screens on top of legitimate apps, it replaces the apps entirely with patched versions that have been stripped of their own security defenses.
Dubbed Hirudo, the malware was detailed this week by Dutch mobile security firm ThreatFabric. According to the company's analysis, the trojan targets eight Indonesian banking applications, swapping the genuine software with modified builds that bypass in-app integrity checks, root detection, and anti-tampering mechanisms. Once the patched app is installed, the attacker effectively controls the client-side environment in which the victim believes they are banking securely.
A Shift in Mobile Fraud Strategy
Android banking trojans have traditionally relied on overlay attacks, in which a malicious app draws a fake login screen over the legitimate banking app to harvest credentials. Banks responded by hardening their apps with runtime protections that detect overlays, hooking frameworks, and rooted devices. Hirudo sidesteps those defenses by attacking the app binary itself.
By delivering a repackaged version of the banking app, the malware author can remove or neuter the very checks that would normally flag a compromised environment. The result is a banking client that looks and behaves like the real thing to the user, but reports whatever the attacker wants to the bank's backend.
How the Trojan Operates
ThreatFabric's report describes a multi-stage infection chain. The dropper is distributed through channels common to Android malware — likely sideloaded APKs or malicious links — and requests the accessibility and installation permissions needed to operate. Once active, Hirudo identifies which of its targeted banking apps are installed on the device and replaces them with patched counterparts.
The patched apps are not simple clones. They are functional banking clients with specific security routines disabled, allowing the malware to intercept credentials, manipulate transaction data, or trigger unauthorized transfers while evading the bank's client-side fraud signals. Because the tampered app still communicates with legitimate banking infrastructure, network-level detections may not flag the activity.
Why Indonesia?
The concentration on Indonesian banks fits a broader pattern. Indonesia has a large and rapidly growing mobile-first banking population, and its financial apps have been a frequent target for regional malware operators. ThreatFabric has previously documented Android trojans aimed at the same market, suggesting an established ecosystem of actors, tooling, and money-mule networks in the region.
Eight targeted apps is a significant number for a single campaign, indicating that the operators either maintain access to a supply of patched APKs or have automated the patching process. That kind of scalability is what turns a targeted experiment into a widespread fraud operation.
Defenses and Limitations
Patching a banking app is not trivial. Modern banking apps are protected with code obfuscation, certificate pinning, and server-side attestation. Hirudo's success against eight apps implies that at least some of those protections were either absent or bypassable in the targeted versions. Banks that rely solely on client-side checks — root detection, emulator detection, debugger detection — are the most exposed, because all of those checks live in code the attacker now controls.
The strongest countermeasure is server-side: device attestation using hardware-backed keys, transaction signing that cannot be replayed, and behavioral analytics that flag anomalies regardless of what the client reports. Google's Play Integrity API and similar attestation services are designed for exactly this scenario, though they require banks to enforce their verdicts consistently.
For users, the practical advice remains unchanged but is worth repeating: install banking apps only from official app stores, keep Android and Google Play Protect up to date, and be suspicious of any prompt to enable installation from unknown sources. Sideloaded banking apps — even ones that look legitimate — should be treated as compromised by default.
The Bigger Picture
Hirudo is a reminder that mobile banking security is a two-sided problem. Banks have spent years hardening their apps against external interference, but an attacker who controls the app itself operates on the inside of that trust boundary. As long as client-side checks are the primary line of defense, repackaging attacks will find a way through.
The full ThreatFabric report, including indicators of compromise and the list of targeted applications, is available via The Hacker News. Financial institutions in the region should review their app integrity controls and assume that at least one patched variant of their client is in circulation.
