Android Malware ‘Hirudo’ Replaces Legitimate Banking Apps to Evade Security Measures

Security researchers have uncovered a new Android malware, named “Hirudo,” that bypasses conventional protection mechanisms by covertly swapping authentic banking applications with malicious duplicates that siphon login credentials.

The trojan first scans the device for a banking app, uninstalls the genuine version, and then installs a tampered look‑alike. Though the fake appears identical, it disables features such as certificate pinning and biometric checks, enabling it to capture usernames, passwords and one‑time codes before sending them to the attackers’ remote servers.

BleepingComputer first reported the finding after a group of analysts reverse‑engineered a sample that had been spread via phishing URLs and third‑party app stores. The malicious code contains a routine that watches for installed banking packages, initiates the replacement, and subsequently wipes its own installation traces to evade typical anti‑malware detection.

If the malware proliferates widely, banks may experience a rise in fraudulent transactions. By subverting safeguards like two‑factor authentication and app‑level encryption, Hirudo can give criminals sustained access to accounts without triggering immediate alerts, a particular worry for users who depend on mobile banking as their main transaction method.