# Hirudo Android Banking RAT Replaces Legitimate Banking Apps With Patched Copies to Bypass Security Checks

> Hirudo is an Android banking trojan and remote access trojan, documented by ThreatFabric, that is delivered through shopping, video and short-drama lure apps showing fake update prompts. Using Accessibility Service, it uninstalls genuine banking apps and installs patched copies with the same package name, whose YAHFA/Dobby hooking engine defeats signature, Accessibility, FLAG_SECURE and Play Integrity checks.

- **Published:** 2026-10-22T12:16:06Z
- **Last reviewed:** 2026-10-22T12:16:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4140
- **ID:** TL-2026-4140
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Hirudo (named by ThreatFabric) is a two-stage Android threat. The first stage is a benign-looking lure app themed around shopping (Shopora, com.agbbh.kjdrttt), adult video (1V1 X, com.onev.vip) or short drama (ZoyaTV, com.zoyatv.app; KoiShort, com.koishort.app). The lures are promoted through fake Google Play landing pages and Facebook, Instagram and TikTok advertisements. After installation the lure shows an in-app fake update prompt that delivers the Hirudo RAT as a separate APK and asks the victim to grant Accessibility permission. One variant uses a blackhole VPN during installation to cut the device's IPv4 traffic, which ThreatFabric reports as a way to avoid Google Play Protect.

Once Accessibility is granted, the RAT detects installed banking apps and checks their signing certificates. It then triggers uninstallation of the genuine app and installs a patched copy with the identical package name and version, signed with a test key. The patched copies are downloaded from operator-controlled CloudFront distributions. A single line is injected into the app's Application class to load a hooking engine built on the open-source YAHFA (Java method replacement) and Dobby (native function hooking) frameworks. The engine activates when the RAT writes a shared file. When queried, the hooks return the genuine signing certificate instead of the test key and return an empty list of enabled Accessibility services. They also strip FLAG_SECURE so the screen can be viewed or recorded remotely. Key attestation is re-signed with a bundled keybox that has leaked publicly; ThreatFabric notes at least two of its certificates appear on Google's attestation revocation list as compromised. Play Integrity requests are relayed over plain HTTP to an operator-controlled server (43.225.157.157:8766/request_token).

The RAT steals login passwords (uploaded as appPwd), payment PINs (appPayPwd) and device-unlock patterns, PINs and passwords. It collects SMS messages with a 90-day initial scan and uses Notification Access. It overlays a transparent WebView on the dropper's order screen, branded for the target bank or wallet and localized into eight languages, that harvests payment PINs and returns a forged payment-success result. Operators can stream the screen live over WebRTC and capture front and rear camera and audio. Control uses HTTP APIs and an MQTT broker on 134.122.153.136, with campaign configuration fetched from jiekou.baojingtextile.cn.

The patched-app replacements target eight Indonesian banking apps from seven banks. Code references and credential registries also cover China, India, Mexico, Morocco and Thailand, and fake checkout branding covers Malaysia (Maybank and a Malaysian wallet, per ThreatFabric). The Play Integrity relay endpoint is shared across four of the patched banking apps. ThreatFabric also found an archived campaign page from June 2026, and notes that the bundled keybox is publicly leaked, so server-side revocation checks can expose the forged attestation. Backend records from August 2026 held thousands of stolen credential and device entries, along with lock-screen history and financial profiles. Download routes were confirmed active in September and October 2026. The sources name no threat actor or nation-state. ThreatFabric's attribution clues are limited to Chinese-language infrastructure naming and commodity tooling (OpenInstall, Meta Pixel).

## MITRE ATT&CK

- T1660 Phishing
- T1204.002 User Execution: Malicious File
- T1575 Native API
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1629 Impair Defenses
- T1407 Download New Code at Runtime
- T1632.001 Subvert Trust Controls: Code Signing Policy Modification
- T1629.003 Impair Defenses: Disable or Modify Tools
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1636.004 SMS Messages
- T1517 Access Notifications
- T1418 Software Discovery
- T1426 System Information Discovery
- T1513 Screen Capture
- T1512 Video Capture
- T1429 Audio Capture
- T1437 Application Layer Protocol
- T1646 Exfiltration Over C2 Channel

## Sources

- [ThreatFabric - Hirudo: From Fake Updates to Patched Banking Apps](https://www.threatfabric.com/blogs/hirudo-from-fake-updates-to-patched-banking-apps)
- [The Hacker News - Hirudo Android Trojan Uses Patched Banking Apps](https://thehackernews.com/2026/10/hirudo-android-trojan-uses-patched.html)
- [BleepingComputer - Hirudo Android malware replaces banking apps to evade security checks](https://www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/)
- [Cyber Security News - New Android Malware Replaces Legitimate Banking Apps With Malicious Copies to Bypass Security Checks](https://cybersecuritynews.com/new-android-malware-2/)
- [Security Affairs - Hirudo Android Trojan Replaces Banking Apps to Steal Credentials](https://securityaffairs.com/?p=200970)
- [SecurityWeek - Novel Android Banking RAT Hirudo Replaces Banking Apps With Trojanized Copies](https://securityweek.com/novel-android-banking-rat-hirudo-replaces-banking-apps-with-trojanized-copies)
- [Daily Security Review - Hirudo Android Trojan Replaces Banking Apps With Patched Copies](https://dailysecurityreview.com/?p=44602)
- [Ankura CTIX FLASH Update - October 16, 2026 (Malware Activity)](https://ankura.com/insights/ankura-ctix-flash-update-october-16-2026)
- [PCrisk - Hirudo Android Trojan Swaps Banking Apps For Self-Blinding Clones](https://www.pcrisk.com/internet-threat-news/36040-hirudo-android-trojan-swaps-banking-apps-for-self-blinding-clones)
- [NEOTEO - ThreatFabric reports Hirudo replaces Android banking apps](https://www.neoteo.com/en/threatfabric-reports-hirudo-replaces-android-banking-apps)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4140