DEV Community

Anoymask
Anoymask

Posted on

Hirudo: Replaces Banking Apps to Tamper with Local Signature, Accessibility, and Play Integrity Checks

#security #threatintel

1. Basic Information

2. Executive Summary

A dropper disguised as shopping and video apps uses a fake update to deploy the Hirudo RAT, which attempts to remove legitimate banking apps and replace them with patched copies. YAHFA and Dobby hooks tamper with the app's local checks for signatures, accessibility, screen capture, and Play Integrity results.

3. Attack Flow

After RAT installation, banking-app replacement and credential theft through fake screens or remote-control features are separate capabilities. Interrupting replacement alone does not establish that the other capabilities have also been stopped.

Common Installation Path

  1. Users install lure APKs after being directed to them through advertisements or similar channels.
  2. A fake in-app update prompts installation of Hirudo as a separate APK, which requests accessibility and notification access.

Banking-App Replacement Path (Seven Banks, Eight Apps)

  1. Hirudo detects a targeted banking app, opens its uninstallation screen, and downloads the patched copy in parallel. Uninstallation and installer authorization are required.
  2. When the patched app starts and the shared trigger file created by the RAT is present, the analyzed hooks interfere with security decisions inside the app.

Related Capabilities (Not Mandatory Steps After Replacement)

  • The RAT collects PINs and passwords through fake payment and authentication screens and sends them to the backend.
  • It also supports screen sharing, camera access, SMS collection, and remote control. These capabilities do not establish that every feature ran on every device.

4. Attacker Positioning and Prerequisites

  • Attackers capable of distributing unofficial APKs, and malware granted accessibility permissions on the device.

5. Observable Indicators for Victims and Administrators

Victim-Side

  • Fake updates, banking-app reinstallations, and fake checkout success screens are displayed.

Administrator-Side

  • Inference: Depending on the management setup and collection capabilities, app inventories may show unknown APKs or replaced banking apps, alongside changes to signatures and accessibility settings. Where network records are collected, traffic to CloudFront or integrity-relay destinations may be available as artifacts.

6. Success and Failure Conditions

Success Conditions

  • Sideloading the lure APK and granting permissions to Hirudo.
  • The banking-app replacement path requires removal of the legitimate app and authorization to install the patched APK. Users can interrupt either step.

Failure Conditions and Defensive Limits

  • Restrict installation of unofficial APKs. Verify Play Integrity server-side, binding the check to the session and protected action, and combine it with attestation-key revocation checks and transaction-risk controls.
  • Inference: Where supported by management or protection products, restrict suspicious APKs, unauthorized accessibility services, and communications with known relay destinations. Do not rely solely on decisions made inside the app.

7. What Happens If the Attack Succeeds

  • Theft of banking credentials, PINs, device-unlock secrets, and SMS messages.
  • Unauthorized transactions enabled by live screen viewing, camera access, and remote control.
  • Bypassing local security controls in banking apps.

8. Observable Logs

The following are investigation candidates. Availability depends on the product, permissions, logging configuration, and retention period. Missing records do not prove that a device was not compromised.

  • Email: Inference: Advertising and web downloads are the principal reported delivery routes; email delivery has not been confirmed.
  • Proxy/SWG/DNS: Inference: Check communications involving CloudFront downloads, helloharmonyos, baojingtextile, and the Play Integrity relay.
  • Endpoint/EDR: Inference: Check for unknown APKs, test-key signatures, accessibility services, and uninstallation of legitimate banking apps.
  • Identity/IdP: Inference: Check banking logins and abrupt changes in device fingerprints.
  • SaaS/Cloud: Inference: Use MDM to compare app inventories and installation sources within its managed scope. Review Play Protect verdict history where the product makes it available.
  • Network: Inference: Check MQTT traffic on ports 1883/1884, HTTP traffic on ports 8085/18085, and WebRTC communications.

9. Verification Scope

Information Theft or Session Compromise Confirmed

  • Scope: Within the scope confirmed by public information
  • Basis: Public information: Backend records obtained by ThreatFabric in August 2026 included thousands of application-credential entries and device records. They did not establish the number of unique victims or successful banking-app replacements.

Internal Assessment Criteria

  • Differentiate contact, execution, data access, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start from unknown APKs, accessibility permissions, banking-app reinstallations, and IOC communications.
  • Initial Verification: Check app inventories, installation sources, signing certificates, accessibility settings, and targeted banking apps.
  • Device and Server Investigation: Isolate the device from the network and collect APK hashes, accessibility data, SMS messages, camera artifacts, and WebRTC artifacts.
  • Authentication and Cloud Investigation: Check banking sessions, beneficiaries, payments, and password resets.
  • Subsequent Operations: Track credential reuse, SIM/SMS abuse, and expansion to other financial apps. Also correlate available communications records for CloudFront and integrity-relay destinations.
  • Containment: Inference: Isolate the device and preserve evidence, then contact the bank through its official channels to check transactions and accounts. Follow the recovery plan and consider a factory reset after assessing the impact of data erasure. Change banking and device credentials from a separate, clean device.
  • Classification: Differentiate lure installation, RAT permissions, banking-app replacement, credential transmission, and unauthorized transactions.

11. Defense and Detection Ideas

  • Single Event: Detect events where a banking app's signature changes to a public test key.
  • Timeline Correlation: Correlate lure installation, fake updates, accessibility use, banking-app uninstall/install events, and external communications.
  • Threat Hunting: Search for IOC hashes, package names, CloudFront routes, and MQTT endpoints.
  • Log Limitations: Prioritize server-side decisions because local device signals can be spoofed by hooks.
  • Prioritized Countermeasures: Prioritize restricting APK sideloading, using MDM, checking attestation revocation, and controlling transaction risks.

12. Facts / Inference / Hypothesis

Facts

  • Hirudo is delivered as a fake update from functional lure apps for shopping, adult video, and short dramas.
  • The RAT includes 42 financial apps in its registry and has dedicated patched APKs for seven banks and eight apps in Indonesia.
  • Its replacement mechanism removes the legitimate app and installs a patched copy with the same package name and version, signed with a public test key.
  • The analyzed patched build uses YAHFA and Dobby to interfere with signing-certificate checks, accessibility-service lists, screen-capture restrictions, key attestation, and Play Integrity decisions. Hook activation requires a shared trigger file created by the RAT.
  • Play Integrity requests are relayed in plain HTTP to the attacker's server. ThreatFabric confirmed that at least two certificates in the bundled, publicly leaked keybox were on Google's attestation revocation list.
  • The RAT supports collection of credentials, payment PINs, device-unlock secrets, SMS messages, screen content, and camera feeds. Thousands of credential entries and device records were exposed on the backend.
  • Lures use CloudFront, OpenInstall, and Meta Pixel, and some routes remained active as of October 2026.

Inference

  • Public facts must be mapped to and verified against internal assets and logs.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "14. Open Questions and Additional Research".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1476 Deliver Malicious Application via Other Means high ThreatFabric reports delivery of lure APKs from sources outside authorized app stores. This is a Mobile delivery technique; the mapping does not establish successful installation on an individual device.
T1417.002 Input Capture: GUI Input Capture high ThreatFabric reports credential-capture capabilities using fake checkout screens and bank-specific input prompts. This maps to the Mobile technique for Android.

14. Open Questions and Additional Research

  • The exact number of victims, fraudulent transfer amounts, and operators have not been disclosed.

15. Impact on SOCs and Organizations

Hirudo can disable defenses inside a banking app's own process and has credential-theft and remote-control capabilities. Relying only on in-app checks to determine whether a device or app is trustworthy can therefore miss compromise. Combine the bank's server-side verification and transaction-risk assessment with monitoring of app signatures and accessibility settings on managed devices. The infrastructure identified by ThreatFabric is centered on Indonesia and can expand to multiple countries. However, numerous backend records should not be equated with victim counts or successful banking-app replacements; assess impact using evidence from your organization's devices and transactions.

16. Summary by Target Audience

  • For SOCs: Trace app replacements, test-key signatures, accessibility use, and integrity relays chronologically.
  • For Administrators: Restrict unofficial APKs. Combine server-side integrity verification bound to the session and protected action with attestation-key revocation checks and transaction-risk controls.
  • For Users: Do not install APKs or in-app updates from unofficial stores, and stop the process if a banking app is being uninstalled and reinstalled.

Top comments (0)