Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions

Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone.

Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself.

Hirudo uses a two-app setup. Victims first install a convincing shopping or entertainment app, including lures branded Shopora, 1V1 X, ZoyaTV or KoiShort.

These apps display real or plausible content but also act as droppers: when the separate Hirudo payload isn’t already installed, the lure shows a fake in-app update that prompts the user to install it.

The payload then seeks permissions that enable its theft and remote-control functions, including Accessibility access and notification access.

With those permissions, operators can collect banking credentials, payment PINs, device-unlock secrets and SMS messages, as well as view the screen over WebRTC and access the phone’s cameras.

Hirudo maintains a registry of 42 financial apps, but ThreatFabric found dedicated replacement packages for eight Indonesian banking apps across seven banks.

When it detects a supported app, the RAT presents another fake update prompt, opens Android’s uninstaller for the genuine app and downloads a modified version.

ThreatFabric Researchers said that, Hirudo can also display a transparent fake checkout over a lure app, capture a payment PIN and return a forged success message to make the transaction appear legitimate.

Banking App Hijacking

The replacement retains the bank app’s package name and version but uses a public Android test key, so it cannot be installed as a normal update over the bank-signed original. The genuine app must first be removed.

The modified app leaves most bank code intact but adds a startup instruction that loads a hooking engine built on the open-source YAHFA and Dobby frameworks.

Once activated, the engine can falsify the app’s view of its signing certificate, hide enabled Android Accessibility services, remove the FLAG_SECURE screen-capture restriction and tamper with key-attestation and Play Integrity checks.

In effect, checks that would ordinarily help identify a compromised environment can be made to return attacker-controlled results.

ThreatFabric notes important limits: the replacement process depends on the victim allowing the original app to be uninstalled and the new package to be installed, steps that can be interrupted.

Researchers also found that a bundled attestation keybox was publicly leaked, with at least two certificates appearing on Google’s revocation list. Server-side revocation checks can therefore help identify these forgeries.

The lures are distributed through Amazon CloudFront, with campaign tracking linked to OpenInstall attribution and Meta Pixel identifiers.

ThreatFabric also found an exposed APK-processing panel used to assemble lure and replacement apps. Some download routes remained live in September and October 2026.

These findings show how familiar advertising and cloud-delivery infrastructure can support malware distribution without relying solely on obviously suspicious download sites.

Indonesia is the focus of the known bank-app replacements, but Hirudo’s code names credential targets in China, India, Mexico, Morocco and Thailand.

Its fake checkout also includes Malaysian bank and wallet branding. ThreatFabric further reported thousands of credential and device records in backend data captured in August 2026, alongside lock-screen history and financial-profile fields.

Hirudo illustrates why banks should not treat an app’s local security signals as conclusive: a replaced app can manipulate what it reports about its own integrity.

ThreatFabric recommends verifying Play Integrity server-side, binding verdicts to sessions and protected actions, checking attestation revocation, and retaining transaction-risk controls for logins, beneficiary changes and payments.

Accessibility and screen-capture indicators remain useful, but should support broader risk scoring rather than act as stand-alone safeguards.

For Android users, the campaign’s key warning is practical: an update prompt inside a shopping or entertainment app can lead to a second, unrelated installation.

Treat requests to install APKs outside trusted app stores with caution, especially when they request Accessibility access or ask you to remove a banking app.

If a banking app unexpectedly disappears or is replaced, avoid signing in and contact the bank through a verified channel.

IOCs

SHA-256	Package	Role
f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248	com.agbbh.kjdrttt	Shopping lure and dropper
0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7	com.onev.vip	1v1 vip lure and dropper
2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b	com.koishort.app	KoiShort lure and dropper (casino route)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.