Hirudo replaces banking apps on Android
Hirudo can swap legitimate banking apps for altered copies on Android and bypass security checks. No bank attack has been confirmed.
An Android trojan identified as Hirudo can uninstall legitimate banking apps and install altered versions that bypass signature checks, accessibility controls, and Play Integrity. Reports cited by Mallory and CHIP also say it can capture credentials, SMS messages, and screens, with references to Mexico among the named targets, though no specific Mexican case has been confirmed.
An Android trojan identified as Hirudo can replace legitimate banking apps with modified versions and take remote control of the device, according to reports cited by Mallory and CHIP. The available information mentions credential targets linked to Mexico, among other countries, but does not confirm an attack on a Mexican bank or fintech.
What does Hirudo do on the phone?
Hirudo can uninstall the original app, install a modified version, and bypass signature checks, accessibility controls, and Play Integrity queries through hooking mechanisms, according to CHIP. The threat can also capture passwords, PINs, SMS messages, and screens, extending the impact beyond a simple visual swap of the app.
Mallory, citing ThreatFabric researchers, reported that patched versions of eight Indonesian banking apps were identified. That detail shows the malware is not tied to a single country or a single bank brand, but can adapt to different targets depending on the environment it finds on the device.
What does the reference to Mexico mean?
The reference to Mexico appears in the material as an indication of targeting, not as confirmation of a local incident. Both Mallory and CHIP mention credential targets associated with Mexico, but the material itself says there is no confirmed Mexican case.
That distinction matters because it prevents the report from being read as a confirmed intrusion against a financial institution in the country. What is established is the trojan's technical ability to replace banking apps and evade controls designed to verify software integrity on Android.
What limits biometrics and two-factor authentication against this attack?
The material does not describe a failure in biometrics or two-factor authentication itself, but an attack focused on the phone's software. If the trojan can install a tampered copy of the app and see what happens on screen, it can intercept credentials and codes before they become an effective defense.
In that scenario, the issue is not just account access, but the replacement of the legitimate interface with one controlled by the attacker. The Hirudo case points to another layer of risk, the Android device itself and the integrity of the apps users believe they are running.
