Threat reportMalwareTL-2026-4134
Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates
Hirudo Android Banking RAT Replaces Legitimate Banking Apps (TL-2026-4134), also tracked as Hirudo, is a high-severity malware campaign, first published 2026-10-22. It has no confirmed attribution, affects Google Android (devices with Accessibility-enabled sideloaded apps), maps to 13 MITRE ATT&CK techniques (T1417.002, T1418, T1437.001), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4134
- Threat ID
- TL-2026-4134
- Also known as
- Hirudo
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, consumer
- Target regions
- indonesia, china, india, mexico, morocco, thailand, malaysia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Hirudo Android Banking RAT Replaces Legitimate Banking Apps
Malware and tooling: Hirudo, Dobby, YAHFA
How Hirudo Android Banking RAT Replaces Legitimate Banking Apps works
Hirudo is an Android banking remote-access trojan delivered through lure apps (Shopora, 1V1 X, ZoyaTV, KoiShort) distributed via Amazon CloudFront, which prompt fake in-app updates. It steals banking credentials, PINs, device-unlock secrets and SMS, enables remote control via WebRTC, and replaces genuine banking apps with modified versions signed with a public Android test key.
Hirudo (documented by ThreatFabric; researcher Eward Driehuis) is a two-stage Android banking RAT. Dropper apps themed as shopping (Shopora, com.agbbh.kjdrttt), short-drama/casino (KoiShort, com.koishort.app), adult/entertainment video (1V1 X, com.onev.vip) and streaming (ZoyaTV, com.zoyatv.app) load legitimate-looking content through a WebView. They are reached via fake Google Play landing pages that victims are assessed to be directed to through ads on Meta-owned platforms; the droppers are hosted on Amazon CloudFront. When a banking app is detected on the device and Hirudo is not yet installed, the dropper shows a fake in-app update prompt that installs the Hirudo payload. One variant configures a non-functional (blackhole) VPN that blocks IPv4 traffic during payload installation, weakening cloud reputation checks such as Google Play Protect and code analysis.
Hirudo's distinguishing technique is app replacement rather than classic overlay attacks. Using Accessibility, it detects a genuine banking app from a registry of 42 financial apps, verifies the app's signing certificate against stored references, triggers uninstallation, and in parallel downloads a patched replacement. Eight Indonesian banking apps across seven banks have dedicated replacements, signed with a public Android test key. A single line injected into the Application class loads a hooking engine built on the open-source YAHFA (Java method replacement) and Dobby (native function hooking) frameworks; hooks activate only when a trigger file exists on the device. The hooks return the genuine signing certificate when queried, return an empty list for enabled Accessibility services, strip FLAG_SECURE so screens can be viewed and recorded, re-sign key-attestation certificates with a leaked public keybox, and relay Play Integrity requests over HTTP to an operator-controlled server.
The payload abuses Accessibility and notification access to capture login credentials (appPwd), payment PINs (appPayPwd) through a fake checkout overlay, device lock-screen patterns/PINs, and SMS (a 90-day initial scan plus a configured list of bank/wallet senders). It streams the screen and exposes front and rear cameras to operators over WebRTC. Credential-stealing code references targets in Indonesia, China, India, Mexico, Morocco and Thailand, and the fake checkout carries Malaysian bank/wallet branding.
Infrastructure includes an HTTP API and MQTT broker on 134.122.153.136, a Play Integrity relay on 43.225.157.157, APK-processing panels on 134.122.153.68/.92, and CloudFront distribution hosts. OpenInstall and Meta Pixel identifiers tie install attribution and advertising to campaign groups. The operator's APK-processing panel was reachable without authentication, and in August 2026 the exposed backend held thousands of credential entries, device records, lock-screen history and financial profiles. Distribution routes were still active in September-October 2026. No threat actor attribution is stated in the sources. Severity is analyst-assigned; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-4134
Credential Access
T1417.002 Input Capture: GUI Input Capture; T1453 Abuse Accessibility Features
Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols; T1544 Ingress Tool Transfer
Collection
T1512 Video Capture; T1517 Access Notifications; T1636.004 Protected User Data: SMS Messages
Persistence
Defense Evasion
T1629.003 Impair Defenses: Disable or Modify Tools; T1655.001 Masquerading: Match Legitimate Name or Location
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- Google — Android (devices with Accessibility-enabled sideloaded apps)
Vulnerable versions: Not specified in sources - Indonesian banks (seven banks, eight apps) — Mobile banking apps replaced with patched copies
Vulnerable versions: Not specified in sources
Remediation for Hirudo Android Banking RAT Replaces Legitimate Banking Apps
Immediate actions
- Block the listed C2, panel, Play Integrity relay and CloudFront hosts at DNS and egress
- Uninstall the lure apps (com.agbbh.kjdrttt, com.onev.vip, com.koishort.app, com.zoyatv.app) and any banking app that was replaced after a fake update prompt, then reinstall from Google Play
- Reset banking credentials, payment PINs and device lock-screen secrets on affected devices from a clean device
- Alert customers of targeted banks to report suspicious in-app update prompts
Workarounds
- Disable install from unknown sources for browsers and messaging apps
- Revoke Accessibility and notification-listener access from non-essential apps
Longer-term hardening
- Treat client-side attestation (Play Integrity, key attestation, signing-certificate checks) as bypassable and add server-side risk and device-binding signals
- Detect banking-app installs signed with the public Android test key or with a certificate that differs from the publisher's
- Restrict sideloading and Accessibility grants on managed devices with MDM and mobile threat defense
- Brief users that legitimate banking apps do not update through in-app prompts from third-party apps
Timeline of Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- Month-level date: ThreatFabric observed an archived attribution page tied to the campaign infrastructure in June 2026.
- Month-level date: a Hirudo RAT build (SHA-256 425cd707...04c83) was observed in July 2026.
- Month-level date: the operator's unauthenticated APK-processing panel and backend were exposed in August 2026, holding thousands of credential entries, device records, lock-screen history and financial profiles.
- Month-level date: lure distribution routes via CloudFront (Shopora, 1V1 X, KoiShort, ZoyaTV) were active in September 2026.
- Month-level date: distribution routes remained active in October 2026, with a later Hirudo build (v7.8.166) documented.
- GBHackers reported the ThreatFabric findings on Hirudo's fake in-app updates and banking-app replacement; The Hacker News, BleepingComputer, SecurityWeek and Security Affairs coverage followed or accompanied it.
Sources cited for Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)
- Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions (GBHackers)
- Hirudo Android Trojan Uses Patched Banking Apps (The Hacker News)
- Hirudo Android malware replaces banking apps to evade security checks (BleepingComputer)
- Hirudo Android Trojan Replaces Banking Apps to Steal Credentials (Security Affairs)
- Novel Android Banking RAT Hirudo Replaces Banking Apps With Trojanized Copies (SecurityWeek)
- Hirudo Android Trojan Swaps Banking Apps For Self-Blinding Clones (PCrisk)
- Hirudo Android Malware: Removal and Bank App Recovery (Gridinsoft)
Detection coverage for TL-2026-4134
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4134 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.