ThreatFabric said it identified malicious copies of eight banking apps that use a hooking engine to bypass app-signature, Accessibility and Play Integrity checks by substituting certificate information or returning empty lists. Hirudo has been observed impersonating at least seven Indonesian banks, with additional targets in China, India, Mexico, Morocco and Thailand.
The malware is typically delivered through apps for shopping (Shopora), adult content (1V1 X) or short drama (ZoyaTV, KoiShort) that appear legitimate and provide the promised functionality. According to the researchers, these apps act as malware loaders, showing a fake update notification that leads to permission-granting prompts, including for Accessibility services.
Once installed, Hirudo launches the real banking app's uninstaller, downloads a patched copy and abuses its Accessibility permission to install it. ThreatFabric notes that this is a delicate, risky process, because the victim can interrupt it at two points.
The malicious copy retains almost all of the original app's code but loads a hooking engine built on the open-source frameworks YAHFA and Dobby. When launched, the patched app substitutes the genuine signing certificate when queried, hides enabled Accessibility services, removes screenshot protection, modifies key-attestation certificates and relays Play Integrity requests through an operator-controlled server.
"With the engine running inside the banking app's own process, the app's defenses are turned against it," the researchers say.
The evasion methods have limits. The bundled attestation keybox has been publicly leaked, and Google lists two of its certificates as compromised, so server-side revocation checks can detect those forgeries.
Once active on a device, Hirudo can steal banking passwords, payment PINs, device-unlock secrets and SMS messages, stream the screen to operators and provide access to both cameras. Its fake checkout pages collect payment PINs and then display a fabricated payment-success result.