Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

What this means for you — Security leader:Hirudo replaces legitimate Indonesian banking apps with patched versions that disable in-app security checks and steal credentials. Review mobile device management policies, consider app allow-listing or banking-specific MDM containers for staff who use Android devices for work, and treat any sideloaded banking app as compromised.

What this means for you — Lean IT orgs:This malware tricks users into installing fake versions of Indonesian banking apps that bypass the bank's own security. Only install banking apps directly from Google Play or your bank's official site; if an app asks you to update outside the Play Store, treat it as suspicious and contact your bank.

What this means for you — MSP:Hirudo targets users of eight Indonesian banks by replacing their apps with modified versions that disable built-in fraud controls. For clients with Android users in Southeast Asia, push Play Protect, block sideloading, and monitor for unusual banking-app update behavior across managed devices.

What this means for you — Researcher:Hirudo is a new Android banking trojan that patches legitimate banking APKs at runtime to neuter root detection, SSL pinning, and other in-app defenses before exfiltrating credentials. Worth tracking as it raises the bar for static analysis and app-reputation systems.