Threat reportMalwareTL-2026-3499
Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity Checks
Hirudo Android Banking Trojan Replaces Indonesian Banking (TL-2026-3499), also tracked as Hirudo RAT, is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Google Android (devices installing the Hirudo droppers), maps to 17 MITRE ATT&CK techniques (T1407, T1417.002, T1418), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-3499
- Threat ID
- TL-2026-3499
- Also known as
- Hirudo RAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, mobile-payments, consumers
- Target regions
- indonesia, china, india, mexico, morocco, thailand, malaysia
- Detection rules
- 9
- Indicators of compromise
- 30
- Updates
- 2026-10-14 · revalidated 1× · latest source
Malware and tooling in Hirudo Android Banking Trojan Replaces Indonesian Banking
Malware and tooling: Hirudo, Dobby, OpenInstall, YAHFA
How Hirudo Android Banking Trojan Replaces Indonesian Banking works
ThreatFabric disclosed Hirudo on 2026-10-14, an Android banking RAT that replaces eight Indonesian banking apps with patched copies carrying a hooking engine, and relays Play Integrity requests to an operator server. It is delivered by shopping, short-drama and entertainment dropper apps via fake Google Play landing pages and Meta ads, and the campaign is ongoing.
Hirudo is an Android banking remote access trojan tracked by ThreatFabric's Mobile Threat Intelligence team (disclosed 2026-10-14). It combines on-device credential theft with live remote control of the victim's phone. Instead of only drawing overlays over a genuine banking app, it tries to replace the banking app with a modified copy that disables the bank's own security checks from the inside.
Delivery: a branded lure app (shopping, adult video or short drama; examples Shopora com.agbbh.kjdrttt, 1V1 X com.onev.vip, KoiShort com.koishort.app, ZoyaTV com.zoyatv.app) carries the RAT as a separate APK and presents it behind a fake in-app 'update' prompt. The lures are promoted through fake Google Play landing pages and ads on Meta platforms. The dropper collects promotion-tracking data, fetches campaign configuration and checks whether the payload is installed with the required permissions. One analysed shopping dropper raises a blackhole VPN during installation, cutting the device's IPv4 traffic while the payload is installed. The hunt source reports this blocks cloud-based security checks. The Hirudo payload installs as a separate package (analysed: com.zk7qpx.mv9wlt, a July build, and com.r9nkvx.qw2mpl, v7.8.166).
Banking-app patching: eight Indonesian banking apps across seven banks have dedicated replacements. The replacement keeps the original package name and version but is signed with a public Android test key. The RAT detects installed banking apps via Accessibility, verifies signing certificates, forces uninstallation of the genuine app and downloads the patched APK. The patch injects a single line into the app's Application class that loads a self-contained hooking engine from bundled assets, built on YAHFA (Java method replacement) and Dobby (native function hooking). The engine activates only when a trigger file exists on the device. It returns the genuine signing certificate and hides the test key, returns an empty list for Accessibility service queries, strips FLAG_SECURE so the screen can be recorded, re-signs key-attestation certificates with a bundled keybox, and relays Play Integrity requests over plain HTTP to an operator-controlled server that returns a verdict for the app to accept. The keybox is a publicly leaked one; ThreatFabric confirmed at least two of its certificates are on Google's attestation revocation list as compromised.
RAT capabilities: fake checkout page rendered in a transparent WebView; bank- and wallet-specific login credential prompts; a full-screen fake pattern overlay capturing the first pattern drawn and direct lock-screen reading via Accessibility to capture the device unlock secret; live screen viewing over WebRTC; front and rear camera sessions; and SMS collection (a 90-day initial scan plus a configured list of bank and wallet senders). Credential targeting in the code registry spans Indonesia, China, India, Mexico, Morocco and Thailand; the fake checkout carries Malaysian bank and wallet branding.
Infrastructure: lure registration/configuration at helloharmonyos.com, a RAT configuration API at jiekou.baojingtextile.cn, HTTP API on 134.122.153.136 (ports 8085, 18085), an MQTT broker on 134.122.153.136 (ports 1883, 1884), an app management console at 18.139.79.161, and an APK-processing panel on 134.122.153.68:8080 and 134.122.153.92:8080 that was reachable without authentication, rebuilt shell and payload APKs and exposed cloud-storage credentials. APKs are served from CloudFront distributions; OpenInstall and Meta Pixel IDs are used for install and campaign attribution. Backend records captured in August 2026 included thousands of application-credential entries split across short-drama and shopping campaign groups, device records, lock-screen history, and financial profiles with monthly-income and risk-score fields; operators annotated records as 'phished'. No named threat actor was attributed in the sources.
MITRE ATT&CK techniques used in TL-2026-3499
Execution
T1407 Download New Code at Runtime
Credential Access
T1417.002 Input Capture: GUI Input Capture; T1417.002 GUI Input Capture
Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols; T1544 Ingress Tool Transfer
Collection
T1512 Video Capture; T1513 Screen Capture; T1517 Access Notifications; T1636.004 Protected User Data: SMS Messages
Defense Evasion
T1516 Input Injection; T1617 Hooking; T1629.003 Impair Defenses: Disable or Modify Tools; T1633.001 Virtualization/Sandbox Evasion: System Checks; T1655.001 Masquerading: Match Legitimate Name or Location
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services
Initial Access
Affected products and versions in Hirudo Android Banking Trojan Replaces Indonesian Banking
- Google — Android (devices installing the Hirudo droppers)
Vulnerable versions: Not version-specific; abuses Accessibility and app-install permissions - Indonesian banks (seven banks, eight apps; names not published in the reviewed sources) — Mobile banking apps replaced by patched copies
Vulnerable versions: Any installed version; replacement keeps original package name and version
Remediation for Hirudo Android Banking Trojan Replaces Indonesian Banking
Immediate actions
- Block the network IOCs (134.122.153.68, 134.122.153.92, 134.122.153.136, 43.225.157.157, 18.139.79.161, helloharmonyos.com, jiekou.baojingtextile.cn) and the listed CloudFront hostnames at DNS/proxy where mobile traffic is inspected
- Hunt MDM/EMM inventory for the dropper packages com.agbbh.kjdrttt, com.onev.vip, com.koishort.app, com.zoyatv.app and payload packages com.zk7qpx.mv9wlt, com.r9nkvx.qw2mpl
- Flag installed banking apps whose signing certificate differs from the bank's release certificate (test-key signed replacements keep the original package name and version)
- Advise affected customers to uninstall the dropper, reinstall banking apps from the official Google Play listing and change credentials, device PIN and pattern
Workarounds
- Disable installation from unknown sources and do not grant Accessibility or install-packages permissions to non-essential apps
- Install apps only from the official Google Play listing reached through the Play Store app, not through ad or landing-page links
Longer-term hardening
- Verify and enforce Play Integrity verdicts server-side, bound to the session and the protected action, and check attestation revocation status
- Treat Accessibility and screenshot-blocking (FLAG_SECURE) as supporting evidence, not blockers
- Apply layered behavioural analytics and retain backend transaction-risk controls at login, credential recovery, beneficiary creation and payment approval
- Educate users that legitimate apps do not deliver banking-app updates through in-app prompts from shopping or entertainment apps
Timeline of Hirudo Android Banking Trojan Replaces Indonesian Banking
- ThreatFabric references an archived Hirudo lure campaign page from June 2026 (day approximate) carrying OpenInstall install-attribution, showing the lure infrastructure predates the July payload build.
- Hirudo RAT payload com.zk7qpx.mv9wlt analysed by ThreatFabric is identified as a 'July build' (2026; day approximate).
- During August 2026 (day approximate), backend records were captured showing thousands of application-credential entries, device records, lock-screen history and financial profiles; operators labelled records 'phished'.
- The Hacker News notes StreamRat, a previous Android threat using similar fake-page distribution tactics, was reported in September 2026 (day approximate; separate family, context only).
- ThreatFabric confirmed the CloudFront APK download routes used by the lures as active from late September into October 2026 (day approximate).
- BleepingComputer reports that Hirudo replaces banking apps with patched versions to evade security checks.
- As of disclosure, the Play Integrity relay (43.225.157.157:8766), APK-processing panels (134.122.153.68/.92:8080), MQTT/HTTP backend (134.122.153.136) and CloudFront APK hosts were documented as operator infrastructure; campaign status ACTIVE.
- The Hacker News reported the campaign as ongoing, targeting eight Indonesian banking apps with wider credential targeting across Indonesia, China, India, Mexico, Morocco and Thailand.
- ThreatFabric's Mobile Threat Intelligence team publicly disclosed Hirudo in 'Hirudo: From Fake Updates to Patched Banking Apps'.
Update history for TL-2026-3499
- 2026-10-14 — Hirudo Android Banking Malware Replaces Banking Apps with Patched Versions to Evade Security Checks: What changed No field escalation; severity HIGH, exploitability ACTIVE and status ACTIVE are unchanged and already match the newer report. New indicators (2) 1 CloudFront distribution domain (d3s06yhcwfnwcx.cloudfront.net, previously tracke
Sources cited for Hirudo Android Banking Trojan Replaces Indonesian Banking
- Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
- Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)
- Hirudo: From Fake Updates to Patched Banking Apps (Malware News mirror)
- ThreatFabric Blogs index
- Indonesia Hit by Android Banking App-Cloning Campaign (Dark Reading, related context)
- Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets (The Hacker News, related context)
Detection coverage for TL-2026-3499
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3499 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.