Android Trojan ‘Hirudo’ Swaps Out Banking Apps to Slip Past Security Checks

A newly identified Android threat dubbed "Hirudo" is sidestepping traditional security layers by silently replacing genuine banking applications with malicious copies that harvest login details, security researchers reported.

The malware operates by first locating a target banking app on the device, then uninstalling the legitimate version and installing a tampered replica. The counterfeit app appears identical to the original, but it disables built‑in security checks such as certificate pinning and biometric verification, allowing it to capture usernames, passwords, and one‑time codes before forwarding the data to remote servers controlled by the attackers.

The discovery was first publicized by BleepingComputer after a team of analysts reverse‑engineered a sample that had been distributed through a combination of phishing links and third‑party app stores. The code includes a routine that monitors the device for installed banking packages, triggers the replacement process, and then erases its own installation traces to avoid detection by standard anti‑malware scanners.

Financial institutions could see a surge in fraudulent transactions if the malware reaches a broad user base. By neutralizing common defenses like two‑factor authentication and app‑level encryption, Hirudo makes it possible for criminals to gain persistent access to accounts without raising immediate alarms. The threat is particularly concerning for users who rely on mobile banking as their primary transaction channel.