Threat reportMalwareTL-2026-4140
Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security Checks
Hirudo Android Banking RAT Replaces Legitimate Banking Apps (TL-2026-4140) is a high-severity malware campaign, first published 2026-10-22. It has no confirmed attribution, affects Google Android (devices installing sideloaded lure apps), maps to 19 MITRE ATT&CK techniques (T1204.002, T1407, T1417.001), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4140
- Threat ID
- TL-2026-4140
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, consumers
- Target regions
- indonesia, china, india, mexico, morocco, thailand, malaysia
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Hirudo Android Banking RAT Replaces Legitimate Banking Apps
Malware and tooling: Hirudo, Dobby, FakeUpdates, MQTT broker on 134.122.153.136:1883/1884, YAHFA
How Hirudo Android Banking RAT Replaces Legitimate Banking Apps works
Hirudo is an Android banking trojan and remote access trojan, documented by ThreatFabric, that is delivered through shopping, video and short-drama lure apps showing fake update prompts. Using Accessibility Service, it uninstalls genuine banking apps and installs patched copies with the same package name, whose YAHFA/Dobby hooking engine defeats signature, Accessibility, FLAG_SECURE and Play Integrity checks.
Hirudo (named by ThreatFabric) is a two-stage Android threat. The first stage is a benign-looking lure app themed around shopping (Shopora, com.agbbh.kjdrttt), adult video (1V1 X, com.onev.vip) or short drama (ZoyaTV, com.zoyatv.app; KoiShort, com.koishort.app). The lures are promoted through fake Google Play landing pages and Facebook, Instagram and TikTok advertisements. After installation the lure shows an in-app fake update prompt that delivers the Hirudo RAT as a separate APK and asks the victim to grant Accessibility permission. One variant uses a blackhole VPN during installation to cut the device's IPv4 traffic, which ThreatFabric reports as a way to avoid Google Play Protect.
Once Accessibility is granted, the RAT detects installed banking apps and checks their signing certificates. It then triggers uninstallation of the genuine app and installs a patched copy with the identical package name and version, signed with a test key. The patched copies are downloaded from operator-controlled CloudFront distributions. A single line is injected into the app's Application class to load a hooking engine built on the open-source YAHFA (Java method replacement) and Dobby (native function hooking) frameworks. The engine activates when the RAT writes a shared file. When queried, the hooks return the genuine signing certificate instead of the test key and return an empty list of enabled Accessibility services. They also strip FLAG_SECURE so the screen can be viewed or recorded remotely. Key attestation is re-signed with a bundled keybox that has leaked publicly; ThreatFabric notes at least two of its certificates appear on Google's attestation revocation list as compromised. Play Integrity requests are relayed over plain HTTP to an operator-controlled server (43.225.157.157:8766/request_token).
The RAT steals login passwords (uploaded as appPwd), payment PINs (appPayPwd) and device-unlock patterns, PINs and passwords. It collects SMS messages with a 90-day initial scan and uses Notification Access. It overlays a transparent WebView on the dropper's order screen, branded for the target bank or wallet and localized into eight languages, that harvests payment PINs and returns a forged payment-success result. Operators can stream the screen live over WebRTC and capture front and rear camera and audio. Control uses HTTP APIs and an MQTT broker on 134.122.153.136, with campaign configuration fetched from jiekou.baojingtextile.cn.
The patched-app replacements target eight Indonesian banking apps from seven banks. Code references and credential registries also cover China, India, Mexico, Morocco and Thailand, and fake checkout branding covers Malaysia (Maybank and a Malaysian wallet, per ThreatFabric). The Play Integrity relay endpoint is shared across four of the patched banking apps. ThreatFabric also found an archived campaign page from June 2026, and notes that the bundled keybox is publicly leaked, so server-side revocation checks can expose the forged attestation. Backend records from August 2026 held thousands of stolen credential and device entries, along with lock-screen history and financial profiles. Download routes were confirmed active in September and October 2026. The sources name no threat actor or nation-state. ThreatFabric's attribution clues are limited to Chinese-language infrastructure naming and commodity tooling (OpenInstall, Meta Pixel).
MITRE ATT&CK techniques used in TL-2026-4140
Execution
T1204.002 User Execution: Malicious File; T1575 Native API
defense-evasion
T1407 Download New Code at Runtime; T1629 Impair Defenses; T1655.001 Masquerading: Match Legitimate Name or Location
collection
T1417.001 Input Capture: Keylogging; T1517 Access Notifications; T1636.004 SMS Messages
credential-access
T1417.002 Input Capture: GUI Input Capture
Discovery
T1418 Software Discovery; T1426 System Information Discovery
Collection
T1429 Audio Capture; T1512 Video Capture; T1513 Screen Capture
command-and-control
T1437 Application Layer Protocol
Defense Evasion
T1629.003 Impair Defenses: Disable or Modify Tools; T1632.001 Subvert Trust Controls: Code Signing Policy Modification
Exfiltration
T1646 Exfiltration Over C2 Channel
initial-access
Affected products and versions in Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- Google — Android (devices installing sideloaded lure apps)
Vulnerable versions: Devices on which the user grants Accessibility Service to the lure or payload apps - Various Indonesian banks — Eight Indonesian mobile banking apps from seven banks (replaced with patched copies; bank names not disclosed in available coverage)
Vulnerable versions: Genuine apps replaced by same-package, test-key-signed copies
Remediation for Hirudo Android Banking RAT Replaces Legitimate Banking Apps
Patches
- No CVE is involved; this is malware abuse of legitimate Android features rather than a software vulnerability
Immediate actions
- Block the Hirudo C2 and distribution IOCs (IPs, jiekou.baojingtextile.cn, www.helloharmonyos.com, listed CloudFront hosts) at DNS, proxy and mobile-gateway layers
- Hunt MDM/EDR inventories for the lure packages com.agbbh.kjdrttt, com.onev.vip, com.koishort.app, com.zoyatv.app and payload packages com.zk7qpx.mv9wlt, com.r9nkvx.qw2mpl
- Force password and PIN resets and review sessions for banking accounts on any affected device; notify banks of exposed customers
- Isolate infected devices, remove the lure and payload apps, and reinstall banking apps only from the official Google Play Store
Workarounds
- Keep Google Play Protect enabled and never install apps or 'updates' from ads, social media links or fake Play Store pages
- Deny Accessibility permission to any shopping, video or entertainment app
Longer-term hardening
- Block sideloading and installs from unknown sources on managed Android devices
- Restrict Accessibility Service and Notification Access grants to allow-listed apps through MDM policy
- Banks should server-side validate app signing certificates and Play Integrity verdicts and avoid trusting client-side attestation alone
- Banks should monitor for revoked or leaked attestation keybox certificates and for behavioral signs of remote-control sessions
Timeline of Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- ThreatFabric references an archived Hirudo campaign page dating to June 2026, the earliest dated artifact tied to the operation (day approximate, month per source).
- A July 2026 build of the Hirudo RAT payload (com.zk7qpx.mv9wlt) is dated by ThreatFabric; day approximate, month per source.
- Operator backend records from August 2026 hold thousands of stolen credential and device entries, lock-screen history and financial profiles (day approximate, month per source).
- ThreatFabric's monitoring period for the lure and patched-app download routes (CloudFront distributions) begins in late September 2026 and confirms them active into October (start day approximate).
- ThreatFabric publishes its analysis of Hirudo, including the patched-banking-app technique and YAHFA/Dobby hooking engine; The Hacker News and BleepingComputer cover it the same day.
- Ankura's CTIX FLASH Update of 16 October 2026 lists Hirudo under malware activity, showing wider industry pickup within two days of disclosure.
- Cyber Security News republishes the findings and reports the campaign as still active; its article dates the ThreatFabric disclosure to 22 October, whereas ThreatFabric's own post is dated 14 October.
Sources cited for Hirudo Android Banking RAT Replaces Legitimate Banking Apps
- ThreatFabric - Hirudo: From Fake Updates to Patched Banking Apps
- The Hacker News - Hirudo Android Trojan Uses Patched Banking Apps
- BleepingComputer - Hirudo Android malware replaces banking apps to evade security checks
- Cyber Security News - New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks
- Security Affairs - Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
- SecurityWeek - Novel Android Banking RAT Hirudo Replaces Banking Apps With Trojanized Copies
- Daily Security Review - Hirudo Android Trojan Replaces Banking Apps With Patched Copies
- Ankura CTIX FLASH Update - October 16, 2026 (Malware Activity)
- PCrisk - Hirudo Android Trojan Swaps Banking Apps For Self-Blinding Clones
- NEOTEO - ThreatFabric reports Hirudo replaces Android banking apps
Detection coverage for TL-2026-4140
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4140 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.