Skip to content
Scammers.com
ImpersonationReviewed

Hirudo Android malware replaces Indonesian banking apps with patched copies

ThreatFabric found "Hirudo", Android malware that swaps real Indonesian banking apps for patched copies to bypass security checks and steal credentials.

First reported
Reports
1

Source: bleepingcomputer.com · published

Illustration: Impersonation scams

What happened

BleepingComputer reported on October 14, 2026 on ThreatFabric research into Hirudo, Android malware that steals bank credentials by replacing legitimate banking apps with modified versions that disable security checks. It has impersonated at least seven Indonesian banks and also targets financial organisations in China, India, Mexico, Morocco and Thailand. The banks were impersonated, not involved.

ThreatFabric found thousands of credential entries in an unsecured backend panel; the number of victims is unknown.

How the scam works

Hirudo arrives through loader apps that seem legitimate and work as promised: shopping (Shopora), adult content (1V1 X) and short drama (ZoyaTV, KoiShort). They show a fake "update" notification leading to permission prompts, including for Accessibility services.

Hirudo then launches the real banking app's uninstaller, downloads a patched copy and uses Accessibility to install it. The copy keeps almost all the original code but adds a hooking engine that fakes the signing certificate, hides Accessibility services, removes screenshot protection and tampers with Play Integrity checks.

Once active it can steal banking passwords, payment PINs, unlock codes and SMS messages, stream the screen and use both cameras. Fake checkout pages collect PINs and show a fake success message.

Source

BleepingComputer, "Hirudo Android malware replaces banking apps to evade security checks" (October 14, 2026), reporting ThreatFabric research.

Red flags

  • An app asking you to install an "update" outside the Play Store.
  • Requests to grant Accessibility permission to a shopping, video or adult app.
  • Your banking app disappearing and being reinstalled.

If you were targeted

  1. 1Install apps only from Google Play and avoid APK files from unofficial stores.
  2. 2Never grant Accessibility access to apps that don't clearly need it.
  3. 3Keep Android updated and run Play Protect scans.
  4. 4If infected, contact your bank from another device, then reset the phone.
ReportFraud.ftc.gov FBI IC3 More resources