# Hirudo Android Banking RAT Replaces Legitimate Banking Apps via Fake In-App Updates

> Hirudo is an Android banking remote-access trojan delivered through lure apps (Shopora, 1V1 X, ZoyaTV, KoiShort) distributed via Amazon CloudFront, which prompt fake in-app updates. It steals banking credentials, PINs, device-unlock secrets and SMS, enables remote control via WebRTC, and replaces genuine banking apps with modified versions signed with a public Android test key.

- **Published:** 2026-10-22T10:35:19Z
- **Last reviewed:** 2026-10-22T10:35:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4134
- **ID:** TL-2026-4134
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hirudo (documented by ThreatFabric; researcher Eward Driehuis) is a two-stage Android banking RAT. Dropper apps themed as shopping (Shopora, com.agbbh.kjdrttt), short-drama/casino (KoiShort, com.koishort.app), adult/entertainment video (1V1 X, com.onev.vip) and streaming (ZoyaTV, com.zoyatv.app) load legitimate-looking content through a WebView. They are reached via fake Google Play landing pages that victims are assessed to be directed to through ads on Meta-owned platforms; the droppers are hosted on Amazon CloudFront. When a banking app is detected on the device and Hirudo is not yet installed, the dropper shows a fake in-app update prompt that installs the Hirudo payload. One variant configures a non-functional (blackhole) VPN that blocks IPv4 traffic during payload installation, weakening cloud reputation checks such as Google Play Protect and code analysis.

Hirudo's distinguishing technique is app replacement rather than classic overlay attacks. Using Accessibility, it detects a genuine banking app from a registry of 42 financial apps, verifies the app's signing certificate against stored references, triggers uninstallation, and in parallel downloads a patched replacement. Eight Indonesian banking apps across seven banks have dedicated replacements, signed with a public Android test key. A single line injected into the Application class loads a hooking engine built on the open-source YAHFA (Java method replacement) and Dobby (native function hooking) frameworks; hooks activate only when a trigger file exists on the device. The hooks return the genuine signing certificate when queried, return an empty list for enabled Accessibility services, strip FLAG_SECURE so screens can be viewed and recorded, re-sign key-attestation certificates with a leaked public keybox, and relay Play Integrity requests over HTTP to an operator-controlled server.

The payload abuses Accessibility and notification access to capture login credentials (appPwd), payment PINs (appPayPwd) through a fake checkout overlay, device lock-screen patterns/PINs, and SMS (a 90-day initial scan plus a configured list of bank/wallet senders). It streams the screen and exposes front and rear cameras to operators over WebRTC. Credential-stealing code references targets in Indonesia, China, India, Mexico, Morocco and Thailand, and the fake checkout carries Malaysian bank/wallet branding.

Infrastructure includes an HTTP API and MQTT broker on 134.122.153.136, a Play Integrity relay on 43.225.157.157, APK-processing panels on 134.122.153.68/.92, and CloudFront distribution hosts. OpenInstall and Meta Pixel identifiers tie install attribution and advertising to campaign groups. The operator's APK-processing panel was reachable without authentication, and in August 2026 the exposed backend held thousands of credential entries, device records, lock-screen history and financial profiles. Distribution routes were still active in September-October 2026. No threat actor attribution is stated in the sources. Severity is analyst-assigned; no CVE or CVSS applies.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1629.003 Impair Defenses: Disable or Modify Tools
- T1625 Hijack Execution Flow
- T1453 Abuse Accessibility Features
- T1417.002 Input Capture: GUI Input Capture
- T1517 Access Notifications
- T1636.004 Protected User Data: SMS Messages
- T1512 Video Capture
- T1418 Software Discovery
- T1544 Ingress Tool Transfer
- T1437.001 Application Layer Protocol: Web Protocols
- T1646 Exfiltration Over C2 Channel

## Sources

- [Hirudo: From Fake Updates to Patched Banking Apps (ThreatFabric)](https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps)
- [Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions (GBHackers)](https://gbhackers.com/banking-app-hijacking/)
- [Hirudo Android Trojan Uses Patched Banking Apps (The Hacker News)](https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html)
- [Hirudo Android malware replaces banking apps to evade security checks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/)
- [Hirudo Android Trojan Replaces Banking Apps to Steal Credentials (Security Affairs)](https://securityaffairs.com/?p=200970)
- [Novel Android Banking RAT Hirudo Replaces Banking Apps With Trojanized Copies (SecurityWeek)](https://securityweek.com/novel-android-banking-rat-hirudo-replaces-banking-apps-with-trojanized-copies)
- [Hirudo Android Trojan Swaps Banking Apps For Self-Blinding Clones (PCrisk)](https://www.pcrisk.com/internet-threat-news/36040-hirudo-android-trojan-swaps-banking-apps-for-self-blinding-clones)
- [Hirudo Android Malware: Removal and Bank App Recovery (Gridinsoft)](https://blog.gridinsoft.com/hirudo-android-malware-removal/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4134