New Android Malware 'Hirudo' Targets Banking Apps

A new Android malware, dubbed Hirudo, has been identified by cybersecurity researchers as a significant threat to banking app users. The malware operates by replacing legitimate banking applications with modified versions that are designed to bypass built-in security checks, allowing cybercriminals to steal bank account credentials.

ThreatFabric, a mobile security company based in the Netherlands, disclosed that Hirudo specifically targets eight Indonesian banking apps. These apps are replaced with purpose-built patched versions that can circumvent various security mechanisms, including app-signature, Accessibility, and Play Integrity checks. This capability allows the malware to operate undetected by the app's security protocols.

According to reports, Hirudo employs a hooking engine to manipulate security checks. It can substitute certificate information or return empty lists, effectively bypassing the app's defenses. This sophisticated approach enables threat actors to gain unauthorized access to sensitive user information.

Beyond credential theft, Hirudo provides cybercriminals with the ability to remotely control infected devices in real time. This includes the capability to collect messages, capture screenshots, and even record audio from the compromised phones. Such extensive control over the device significantly increases the potential damage that can be inflicted on victims.

The discovery of Hirudo highlights the evolving tactics of cybercriminals in targeting mobile banking applications. Users of the affected Indonesian banking apps are advised to remain vigilant and ensure that their devices are protected with up-to-date security measures. As the threat landscape continues to evolve, cybersecurity experts emphasize the importance of maintaining robust security practices to safeguard personal and financial information.