# Hirudo Android Banking Trojan Replaces Indonesian Banking Apps with Patched Copies and Relays Play Integrity Checks

> ThreatFabric disclosed Hirudo on 2026-10-14, an Android banking RAT that replaces eight Indonesian banking apps with patched copies carrying a hooking engine, and relays Play Integrity requests to an operator server. It is delivered by shopping, short-drama and entertainment dropper apps via fake Google Play landing pages and Meta ads, and the campaign is ongoing.

- **Published:** 2026-10-14T11:49:15Z
- **Last reviewed:** 2026-10-14T12:04:45.121Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3499
- **ID:** TL-2026-3499
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hirudo is an Android banking remote access trojan tracked by ThreatFabric's Mobile Threat Intelligence team (disclosed 2026-10-14). It combines on-device credential theft with live remote control of the victim's phone. Instead of only drawing overlays over a genuine banking app, it tries to replace the banking app with a modified copy that disables the bank's own security checks from the inside.

Delivery: a branded lure app (shopping, adult video or short drama; examples Shopora com.agbbh.kjdrttt, 1V1 X com.onev.vip, KoiShort com.koishort.app, ZoyaTV com.zoyatv.app) carries the RAT as a separate APK and presents it behind a fake in-app 'update' prompt. The lures are promoted through fake Google Play landing pages and ads on Meta platforms. The dropper collects promotion-tracking data, fetches campaign configuration and checks whether the payload is installed with the required permissions. One analysed shopping dropper raises a blackhole VPN during installation, cutting the device's IPv4 traffic while the payload is installed. The hunt source reports this blocks cloud-based security checks. The Hirudo payload installs as a separate package (analysed: com.zk7qpx.mv9wlt, a July build, and com.r9nkvx.qw2mpl, v7.8.166).

Banking-app patching: eight Indonesian banking apps across seven banks have dedicated replacements. The replacement keeps the original package name and version but is signed with a public Android test key. The RAT detects installed banking apps via Accessibility, verifies signing certificates, forces uninstallation of the genuine app and downloads the patched APK. The patch injects a single line into the app's Application class that loads a self-contained hooking engine from bundled assets, built on YAHFA (Java method replacement) and Dobby (native function hooking). The engine activates only when a trigger file exists on the device. It returns the genuine signing certificate and hides the test key, returns an empty list for Accessibility service queries, strips FLAG_SECURE so the screen can be recorded, re-signs key-attestation certificates with a bundled keybox, and relays Play Integrity requests over plain HTTP to an operator-controlled server that returns a verdict for the app to accept. The keybox is a publicly leaked one; ThreatFabric confirmed at least two of its certificates are on Google's attestation revocation list as compromised.

RAT capabilities: fake checkout page rendered in a transparent WebView; bank- and wallet-specific login credential prompts; a full-screen fake pattern overlay capturing the first pattern drawn and direct lock-screen reading via Accessibility to capture the device unlock secret; live screen viewing over WebRTC; front and rear camera sessions; and SMS collection (a 90-day initial scan plus a configured list of bank and wallet senders). Credential targeting in the code registry spans Indonesia, China, India, Mexico, Morocco and Thailand; the fake checkout carries Malaysian bank and wallet branding.

Infrastructure: lure registration/configuration at helloharmonyos.com, a RAT configuration API at jiekou.baojingtextile.cn, HTTP API on 134.122.153.136 (ports 8085, 18085), an MQTT broker on 134.122.153.136 (ports 1883, 1884), an app management console at 18.139.79.161, and an APK-processing panel on 134.122.153.68:8080 and 134.122.153.92:8080 that was reachable without authentication, rebuilt shell and payload APKs and exposed cloud-storage credentials. APKs are served from CloudFront distributions; OpenInstall and Meta Pixel IDs are used for install and campaign attribution. Backend records captured in August 2026 included thousands of application-credential entries split across short-drama and shopping campaign groups, device records, lock-screen history, and financial profiles with monthly-income and risk-score fields; operators annotated records as 'phished'. No named threat actor was attributed in the sources.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1629.003 Impair Defenses: Disable or Modify Tools
- T1633.001 Virtualization/Sandbox Evasion: System Checks
- T1417.002 Input Capture: GUI Input Capture
- T1417.002 GUI Input Capture
- T1636.004 Protected User Data: SMS Messages
- T1513 Screen Capture
- T1512 Video Capture
- T1516 Input Injection
- T1544 Ingress Tool Transfer
- T1437.001 Application Layer Protocol: Web Protocols
- T1418 Software Discovery
- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1617 Hooking
- T1517 Access Notifications
- T1407 Download New Code at Runtime

## Sources

- [Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks](https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html)
- [Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)](https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps)
- [Hirudo: From Fake Updates to Patched Banking Apps (Malware News mirror)](https://malware.news/t/hirudo-from-fake-updates-to-patched-banking-apps/126384)
- [ThreatFabric Blogs index](https://www.threatfabric.com/blogs)
- [Indonesia Hit by Android Banking App-Cloning Campaign (Dark Reading, related context)](https://www.darkreading.com/mobile-security/indonesia-android-banking-app-cloning-campaign)
- [Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets (The Hacker News, related context)](https://thehackernews.com/2026/03/six-android-malware-families-target-pix.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3499