ThreatFabric details Hirudo, an Android banking trojan that replaces legitimate banking apps with patched versions.
It uses droppers, accessibility services to automate uninstallation, and embedded hooking engines to bypass Play Integrity checks.
The perpetrators spread the malicious program hidden inside applications such as Shopora, 1V1 X, KoiShort, and ZoyaTV. These applications are promoted through advertisements on Meta platforms, using fake websites that resemble the official Google app store. When the user downloads one of them, the program displays fake update messages to trick them into installing the real malicious software.
How it bypasses device security
Before proceeding with the installation, the program sets up a deliberately faulty internet connection. In this way, it attempts to bypass the device's security checks.
It then uses the phone's accessibility features to detect banking apps that are already installed. When it finds one, it automatically opens the uninstaller to remove it and downloads its fake version.
READ ALSO
Ledger Reconsiders Sales After $93 Million Theft
This new fake app has a built-in mechanism that bypasses authentication and security checks. The attackers use stolen digital keys to make the apps appear secure, while verification requests are sent via a simple login.
Which countries are affected?
So far, researchers have identified modified versions targeting eight banking apps in Indonesia. The program's data theft and activity is also expanding to users in China, India, Mexico, Morocco, and Thailand.
Once the fake app is installed, the scammers gain the ability to monitor the victim's screen and camera, steal passwords, read private messages, and take full control of the device remotely.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)